CVE-2020-24987
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on Tenda AC18 routers without authentication when the administrator UI is configured to use RADIUS authentication. The flaw exists in the logincheck() function's incorrect authentication handling. All users of affected Tenda AC18 router versions are at risk.
💻 Affected Systems
- Tenda AC18 Router
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete router compromise allowing attacker to install persistent malware, intercept all network traffic, pivot to internal networks, and use router as botnet node.
Likely Case
Router takeover enabling traffic interception, DNS manipulation, credential theft, and lateral movement to connected devices.
If Mitigated
Limited impact with proper network segmentation and monitoring, though router would still be compromised.
🎯 Exploit Status
Exploit requires specific RADIUS configuration but no authentication. Proof-of-concept details are publicly available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after V15.03.05.05_EN and V15.03.05.19(6318) CN
Vendor Advisory: https://www.tendacn.com/en/product/AC18.html
Restart Required: Yes
Instructions:
1. Log into router admin interface. 2. Navigate to firmware update section. 3. Download latest firmware from Tenda website. 4. Upload and apply firmware update. 5. Reboot router after update completes.
🔧 Temporary Workarounds
Disable RADIUS Authentication
allChange administrator authentication from RADIUS to local authentication or disable remote admin access.
Login to router admin interface and change Authentication Method from RADIUS to Local
Restrict Admin Interface Access
allLimit admin interface access to specific IP addresses or disable WAN admin access.
Configure firewall rules to restrict admin port access to trusted IPs only
🧯 If You Can't Patch
- Isolate router on separate VLAN with strict firewall rules limiting traffic to/from router
- Implement network monitoring for unusual router traffic patterns or connection attempts
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via admin interface and verify if RADIUS authentication is enabled for admin UI.Check Version:
Login to router admin interface and check System Status or Firmware Version pageVerify Fix Applied:
Verify firmware version is newer than affected versions and test RADIUS authentication functionality.📡 Detection & Monitoring
Log Indicators:
- Unusual authentication attempts to admin interface
- Unexpected process execution on router
- Configuration changes without authorized user
Network Indicators:
- Unusual outbound connections from router
- Traffic redirection patterns
- DNS query anomalies
SIEM Query:
source="router_logs" AND (event_type="auth_failure" OR event_type="config_change") AND user="unknown"🔗 References
- https://cwe.mitre.org/data/definitions/287.html
- https://drive.google.com/file/d/1iqpr0EofOBC6kCq2USTOBPRlJu_naFjQ/view?usp=sharing
- https://www.tendacn.com/en/product/AC18.html
- https://cwe.mitre.org/data/definitions/287.html
- https://drive.google.com/file/d/1iqpr0EofOBC6kCq2USTOBPRlJu_naFjQ/view?usp=sharing
- https://www.tendacn.com/en/product/AC18.html
