CVE-2021-45992
📋 TL;DR
This CVE describes a stack overflow vulnerability in Tenda G1 and G3 routers that allows attackers to cause a Denial of Service (DoS) by sending specially crafted requests to the qvlanName parameter. The vulnerability affects users running specific firmware versions on these router models. Attackers can exploit this remotely without authentication.
💻 Affected Systems
- Tenda G1 Router
- Tenda G3 Router
📦 What is this software?
G1 Firmware by Tendacn
G3 Firmware by Tendacn
⚠️ Risk & Real-World Impact
Worst Case
Complete router crash requiring physical reboot, potential remote code execution if stack overflow can be controlled to execute arbitrary code (though not confirmed in this CVE).
Likely Case
Router becomes unresponsive, requiring reboot to restore functionality, disrupting network connectivity for all connected devices.
If Mitigated
If routers are behind firewalls with restricted WAN access, risk is limited to internal attackers or compromised internal hosts.
🎯 Exploit Status
Proof of concept code is publicly available on GitHub. Exploitation requires sending crafted HTTP requests to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates. 2. If update available, download and install via router admin interface. 3. Reboot router after installation.
🔧 Temporary Workarounds
Disable remote administration
allPrevent external access to router administration interface
Network segmentation
allPlace routers in isolated network segments with strict firewall rules
🧯 If You Can't Patch
- Replace affected routers with different models or brands
- Implement strict network access controls to limit who can reach router management interface
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface. If version matches affected version, assume vulnerable.Check Version:
Login to router admin interface and check firmware version in System Status or similar sectionVerify Fix Applied:
Verify firmware version has been updated to a version newer than v15.11.0.17(9502)_CN📡 Detection & Monitoring
Log Indicators:
- Multiple failed HTTP requests to router management interface
- Router crash/reboot logs
- Unusual traffic to formSetQvlanList endpoint
Network Indicators:
- HTTP POST requests with unusually long qvlanName parameter
- Traffic to router management port (typically 80/443) from unexpected sources
SIEM Query:
source_ip=* dest_ip=[ROUTER_IP] dest_port=80 OR dest_port=443 http_uri="*formSetQvlanList*" http_param="qvlanName" length>100