CVE-2021-45994
📋 TL;DR
This CVE describes a stack overflow vulnerability in Tenda G1 and G3 routers that allows attackers to cause a Denial of Service (DoS) by exploiting the delDhcpIndex parameter in the formDelDhcpRule function. Attackers can crash the router's web interface or potentially execute arbitrary code. Only users of specific Tenda router models with vulnerable firmware versions are affected.
💻 Affected Systems
- Tenda G1 Router
- Tenda G3 Router
📦 What is this software?
G1 Firmware by Tendacn
G3 Firmware by Tendacn
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete router compromise, persistent backdoor installation, and network traffic interception.
Likely Case
Denial of Service causing router reboot or web interface crash, disrupting network connectivity.
If Mitigated
Limited to DoS with quick recovery if proper network segmentation and monitoring are in place.
🎯 Exploit Status
Proof-of-concept code is publicly available on GitHub. Exploitation requires network access to router's web interface.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates. 2. Download latest firmware for your model. 3. Log into router admin interface. 4. Navigate to System Tools > Firmware Upgrade. 5. Upload and install new firmware. 6. Reboot router.
🔧 Temporary Workarounds
Disable Remote Management
allPrevent external access to router web interface
Network Segmentation
allIsolate router management interface to trusted network
🧯 If You Can't Patch
- Replace affected routers with updated models or different brands
- Implement strict firewall rules blocking all external access to router management interface
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface under System Status or System ToolsCheck Version:
Login to router web interface and check System Status pageVerify Fix Applied:
Verify firmware version is newer than v15.11.0.17(9502)_CN and test web interface functionality📡 Detection & Monitoring
Log Indicators:
- Multiple failed login attempts to router admin interface
- Unusual HTTP POST requests to formDelDhcpRule endpoint
- Router reboot events in system logs
Network Indicators:
- Unusual traffic to router port 80/443 from external IPs
- HTTP requests with malformed delDhcpIndex parameter
SIEM Query:
source="router_logs" AND (uri="/goform/DelDhcpList" OR uri="/goform/formDelDhcpRule") AND (status=500 OR method=POST)