CVE-2023-27013
📋 TL;DR
This vulnerability in Tenda AC10 routers allows attackers to trigger a stack overflow via the get_parentControl_list_Info function. Attackers can cause Denial of Service or execute arbitrary code by sending a specially crafted payload. Users of Tenda AC10 routers with the vulnerable firmware version are affected.
💻 Affected Systems
- Tenda AC10
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with remote code execution, allowing attackers to take complete control of the router, intercept network traffic, and pivot to internal networks.
Likely Case
Router crash causing Denial of Service, requiring physical reset or power cycle to restore functionality.
If Mitigated
Limited impact if router is behind firewall with restricted WAN access and proper network segmentation.
🎯 Exploit Status
Public proof-of-concept exists in GitHub repository. Exploitation requires sending crafted HTTP requests to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: No official vendor advisory found
Restart Required: Yes
Instructions:
1. Check Tenda official website for firmware updates
2. If update available, download and flash via web interface
3. If no update, consider replacing router with supported model
🔧 Temporary Workarounds
Disable remote management
allPrevent external access to router management interface
Network segmentation
allIsolate router management interface to trusted network segment
🧯 If You Can't Patch
- Replace router with supported model from different vendor
- Place router behind firewall with strict inbound rules blocking all unnecessary ports
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in web interface at System Status > Firmware VersionCheck Version:
No CLI command - check via web interface or router labelVerify Fix Applied:
Verify firmware version has changed from US_AC10V4.0si_V16.03.10.13_cn📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP requests to parentControl endpoint
- Router crash/reboot logs
- Memory corruption errors in system logs
Network Indicators:
- HTTP POST requests with unusually large payloads to /goform/setParentControlInfo
- Traffic patterns suggesting router exploitation
SIEM Query:
http.method:POST AND http.uri:"/goform/setParentControlInfo" AND bytes_out:>10000