CVE-2023-37711
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on affected Tenda routers via a stack overflow in the deviceId parameter. Attackers can gain full control of the device without authentication. Users of Tenda AC1206 and AC10 routers with specific firmware versions are affected.
💻 Affected Systems
- Tenda AC1206
- Tenda AC10
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device takeover leading to network compromise, data interception, and use as a botnet node.
Likely Case
Remote code execution allowing attackers to modify router settings, intercept traffic, or install malware.
If Mitigated
Limited impact if device is behind firewall with restricted WAN access and proper network segmentation.
🎯 Exploit Status
Public exploit code available in GitHub repositories. No authentication required for exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check Tenda support website for firmware updates
2. Download latest firmware for your model
3. Upload via router web interface
4. Reboot router after update
🔧 Temporary Workarounds
Disable Remote Management
allPrevent external access to router web interface
Network Segmentation
allIsolate router management interface to trusted network
🧯 If You Can't Patch
- Replace affected routers with patched models from different vendors
- Place routers behind dedicated firewall with strict inbound rules
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in web interface under System Status or About pageCheck Version:
Check router web interface or use nmap scan for banner grabbingVerify Fix Applied:
Verify firmware version is newer than affected versions listed📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to saveParentControlInfo endpoint
- Multiple failed login attempts followed by successful exploitation
Network Indicators:
- Unusual outbound connections from router
- Traffic patterns suggesting command and control communication
SIEM Query:
source_ip=router_ip AND (uri_path="*saveParentControlInfo*" OR user_agent="*curl*" OR user_agent="*wget*")