External risk intelligence

Tenda i24 Buffer Overflow in MAC Filter

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2024-57483

The Tenda i24 is a wireless access point. Such networking devices are frequently deployed as edge or infrastructure equipment that may be reachable via network interfaces, and management functions or configuration features are often accessible within the deployment environment, making internet or network-side exposure a common deployment characteristic.

Buffer Overflow

Tenda I24 Firmware

2.0.0.5

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory highlights a critical vulnerability in Tenda network devices, specifically a buffer overflow. This type of flaw can allow unauthorized access and control over the affected systems, potentially impacting network integrity and data confidentiality. The main concern is to confirm if these devices are in use and assess any potential exposure.

Overflow flaw in network device software.
Critical flaw could enable unauthorized access.
Confirm device presence and assess risk.

Attack Path

How an attacker could exploit the issue

An attacker could reach the vulnerable component by sending specially crafted network requests. This exposure allows an unauthenticated attacker to trigger a buffer overflow within the `addWifiMacFilter` function. Successful exploitation could lead to high impact on confidentiality, integrity, and availability.

No authentication required.
Overflowing a buffer via network requests.
Complete system compromise.

Live Threat

Current exploitation, exposure, and threat context

A buffer overflow vulnerability in the addWifiMacFilter function of the Tenda i24 router could allow an unauthenticated, remote attacker to execute arbitrary code. This could occur when the device is reachable via its network interface and a specially crafted request is sent to the affected function.

Device configuration and control.
Network requests to the router.
Compromise of network access.

Operational Fix

Recommended remediation, mitigation, and detection steps

Addressing this critical vulnerability requires a coordinated effort, likely involving infrastructure or platform teams responsible for network devices, and potentially vendor management if a firmware update is needed. The immediate priority is to discover where the affected Tenda i24 devices are deployed, confirm their network exposure and business criticality, identify the accountable owners, and then develop a risk-based remediation plan.

Infrastructure teams likely own the issue.
Verify device network exposure and criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Tenda i24 and how is it used?

The Tenda i24 is a wireless access point designed to provide network connectivity. It serves as infrastructure hardware that manages traffic and wireless configurations for users and devices within an environment.

What does CWE-120 mean for CVE-2024-57483?

CVE-2024-57483 is classified as CWE-120, a classic buffer overflow weakness. This means the affected software function fails to properly check the size of input data, allowing it to overwrite adjacent memory, which can lead to system crashes or unauthorized execution.

How does an attacker trigger the buffer overflow?

The flaw is triggered by sending a specially crafted network request to the addWifiMacFilter function. Because this function is designed to handle network configurations, it does not require prior authentication. Simply accessing the management interface from the network is sufficient to reach the vulnerable code.

Is my Tenda i24 at risk if it is not on the internet?

Halo Surface Signal identifies that while these devices are frequently internet-facing, they are inherently network-based. Even if not directly on the public internet, the device is reachable by any actor on the local or connected network who can send requests to its configuration interface.

Do I need to replace my device to fix this?

Not necessarily. Your first step should be to confirm where these devices are deployed and identify the owners. Then, verify if the vendor has released a firmware update to patch the addWifiMacFilter function. Remediation typically involves applying these vendor-supplied updates or restricting network access to the device's management functions.

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.