CVE-2023-33673
📋 TL;DR
This vulnerability is a stack overflow in Tenda AC8 routers via the firewallEn parameter in the formSetFirewallCfg function. It allows remote attackers to execute arbitrary code or cause denial of service. Affects users of Tenda AC8 routers with vulnerable firmware.
💻 Affected Systems
- Tenda AC8 router
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to full device compromise, network takeover, and lateral movement.
Likely Case
Denial of service causing router crashes and network disruption.
If Mitigated
Limited impact if isolated from untrusted networks and patched promptly.
🎯 Exploit Status
Public proof-of-concept available on GitHub; exploitation appears straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
Check Tenda website for firmware updates; if available, download and flash via admin interface.
🔧 Temporary Workarounds
Disable remote management
allPrevents external exploitation by disabling remote access features.
Access router admin panel > Advanced > Remote Management > Disable
Network segmentation
allIsolate router management interface from untrusted networks.
Configure firewall rules to restrict access to router IP on port 80/443
🧯 If You Can't Patch
- Replace router with a non-vulnerable model
- Implement strict network access controls and monitor for exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router admin panel under System Status.Check Version:
Not applicable; use web interface at http://router_ipVerify Fix Applied:
Verify firmware version is updated to a non-vulnerable release.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to formSetFirewallCfg
- Router crash logs
Network Indicators:
- Traffic to router management interface with malformed firewallEn parameter
SIEM Query:
http.method:POST AND http.uri:"/goform/setFirewallCfg" AND http.param:"firewallEn"