CVE-2024-51316: Tenda TX9 Denial of Service Vulnerability

CVE-2024-51316 Overview

CVE-2024-51316 is a denial of service vulnerability in the Tenda TX9 router running firmware version V22.03.02.20. The flaw resides in the update_dev_name function invoked through the /goform/SetOnlineDevName endpoint. A remote, unauthenticated attacker can send a crafted HTTP request to this endpoint and cause the device to become unresponsive. The issue is classified as uncontrolled resource consumption [CWE-400] and affects the availability of the router without impacting confidentiality or integrity.

Critical Impact
Remote unauthenticated attackers can crash the Tenda TX9 router by sending a malformed request to /goform/SetOnlineDevName, disrupting network connectivity for all downstream clients.

Affected Products

Tenda TX9 router
Firmware version V22.03.02.20
Web management interface endpoint /goform/SetOnlineDevName

Discovery Timeline

2026-07-20 - CVE-2024-51316 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2024-51316

Vulnerability Analysis

The vulnerability exists in the update_dev_name handler exposed through the /goform/SetOnlineDevName web endpoint of the Tenda TX9 firmware. This endpoint processes online device name update requests submitted via the router's HTTP management interface. When the handler receives a crafted devName parameter, it fails to properly bound or validate the input before consuming device resources.

The result is a resource exhaustion condition consistent with [CWE-400]. The router becomes unresponsive and stops forwarding traffic until it is rebooted. Because the endpoint is reachable over the network and requires no authentication or user interaction, exploitation is trivial for anyone with access to the router's management interface. According to EPSS data published on 2026-07-23, the probability of exploitation activity is low, but the operational impact remains significant for exposed devices.

Root Cause

The root cause is improper handling of user-supplied input in the update_dev_name function. The function does not enforce adequate length or content constraints on the devName field before processing it. This missing validation allows attacker-controlled input to trigger uncontrolled resource consumption inside the router's HTTP daemon.

Attack Vector

An attacker sends a single HTTP POST request to /goform/SetOnlineDevName containing a malformed devName parameter. The request originates from the network and does not require credentials or user interaction. On processing, the router's web service consumes excessive resources and stops responding. Refer to the Gitee IoT Vulnerability Report for the technical proof-of-concept details.

Detection Methods for CVE-2024-51316

Indicators of Compromise

Unexpected HTTP POST requests to /goform/SetOnlineDevName from untrusted sources on the LAN or WAN interface.
Router management interface becoming unresponsive shortly after receiving requests to the SetOnlineDevName endpoint.
Loss of network connectivity for clients behind the Tenda TX9 requiring device reboot to restore service.

Detection Strategies

Inspect HTTP request logs on any network monitoring appliance placed in front of the router for repeated calls to /goform/SetOnlineDevName with oversized devName values.
Deploy signature-based intrusion detection rules that match on the specific goform path combined with abnormally long parameter payloads.
Correlate router availability alerts with inbound HTTP requests to the management interface to identify triggering traffic.

Monitoring Recommendations

Monitor router uptime and management interface reachability with regular health checks to detect service crashes.
Log all requests to /goform/* endpoints and alert on requests from unexpected source addresses.
Track firmware version inventory to identify devices still running V22.03.02.20 or earlier.

How to Mitigate CVE-2024-51316

Immediate Actions Required

Restrict access to the router's HTTP management interface to trusted management VLANs only.
Disable remote WAN-side administration if it is currently enabled on the Tenda TX9.
Apply firewall rules blocking untrusted hosts from reaching /goform/SetOnlineDevName.

Patch Information

At the time of publication, no vendor-specific patch is referenced in the NVD entry for CVE-2024-51316. Administrators should check the Tenda Firmware Download Page for any updated firmware releases addressing this vulnerability and apply them once available.

Workarounds

Segment the router's management network from general-purpose user networks to reduce the attack surface.
Replace affected devices with alternative hardware if a patched firmware is not released and the router is exposed to untrusted networks.
Implement upstream access control lists that drop HTTP traffic to the management interface from all but a small set of administrative hosts.

bash

# Example: block untrusted access to the Tenda TX9 web interface
# Replace 192.0.2.10 with the trusted admin host and 192.168.0.1 with the router IP
iptables -A FORWARD -p tcp -d 192.168.0.1 --dport 80 -s 192.0.2.10 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.168.0.1 --dport 80 -j DROP