CVE-2022-24154 – This vulnerability is a stack overflow in Tenda... (How to Fix)

📋 TL;DR

This vulnerability is a stack overflow in Tenda AX3 routers running firmware version 16.03.12.10_CN. Attackers can send specially crafted rebootTime parameter to the formSetRebootTimer function, causing a denial of service by crashing the device. Users of affected Tenda AX3 routers with this specific firmware are at risk.

💻 Affected Systems

Products:

Tenda AX3

Versions: v16.03.12.10_CN

Operating Systems: Embedded router firmware

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects Chinese firmware version. International versions may have different codebase.

📦 What is this software?

Ax3 Firmware by Tenda

View all CVEs affecting Ax3 Firmware →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete device crash requiring physical power cycle, potentially leading to extended network downtime and loss of connectivity for all connected devices.

🟠

Likely Case

Router becomes unresponsive, requiring manual reboot to restore functionality, causing temporary network disruption.

🟢

If Mitigated

If properly segmented and firewalled, impact limited to isolated network segment with minimal business disruption.

🌐 Internet-Facing: HIGH - Routers are typically internet-facing devices, making them directly accessible to attackers.

🏢 Internal Only: LOW - This vulnerability requires access to the router's management interface, which should not be exposed internally without authentication.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Public GitHub repository contains proof-of-concept code. Exploitation requires network access to router's web interface.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Unknown

Vendor Advisory: Not available

Restart Required: Yes

Instructions:

1. Check Tenda official website for firmware updates
2. If update available, download and upload via router web interface
3. Factory reset recommended after update
4. Verify new firmware version

🔧 Temporary Workarounds

Disable Remote Management

all

Prevent external access to router management interface

Network Segmentation

all

Isolate router management interface to trusted network only

🧯 If You Can't Patch

Replace affected router with different model or vendor
Implement network monitoring for DoS attempts against router management interface

🔍 How to Verify

Check if Vulnerable:

Check router firmware version in web interface under System Status or About page

Check Version:

Check via router web interface or SSH if enabled: cat /proc/version

Verify Fix Applied:

Verify firmware version is no longer v16.03.12.10_CN

📡 Detection & Monitoring

Log Indicators:

Multiple POST requests to formSetRebootTimer endpoint
Router crash/reboot logs
Unusual parameter values in rebootTime field

Network Indicators:

HTTP POST requests with malformed rebootTime parameter to router IP
Sudden loss of router connectivity

SIEM Query:

source="router_logs" AND (uri_path="/goform/SetRebootTimer" OR message="rebootTime")

📊 Metadata

CVE ID: CVE-2022-24154

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-787

Published: February 4, 2022

Last Updated: November 21, 2024

🔗 References

https://github.com/pjqwudi/my_vuln/blob/main/Tenda/vuln_30/30.md Broken Link,Exploit,Third Party Advisory
https://github.com/pjqwudi/my_vuln/blob/main/Tenda/vuln_30/30.md Broken Link,Exploit,Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2022-24154, you might also want to check these: