CVE-2023-38936
📋 TL;DR
This CVE describes a stack overflow vulnerability in multiple Tenda router models via the speed_dir parameter in the formSetSpeedWan function. Attackers can exploit this to execute arbitrary code or cause denial of service. Users of affected Tenda router models with specified firmware versions are vulnerable.
💻 Affected Systems
- Tenda AC10
- Tenda AC1206
- Tenda AC6
- Tenda AC7
- Tenda AC5
- Tenda FH1203
- Tenda AC9
- Tenda FH1205
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, attacker persistence, and lateral movement into internal networks.
Likely Case
Router crash causing denial of service, requiring physical reset to restore functionality.
If Mitigated
Limited impact if routers are behind firewalls with strict inbound filtering and not internet-facing.
🎯 Exploit Status
Public proof-of-concept exists in GitHub repositories, making exploitation straightforward for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: Yes
Instructions:
Check Tenda website for firmware updates. If available, download and flash via router web interface. Factory reset recommended after update.
🔧 Temporary Workarounds
Disable WAN management access
allPrevent external access to router management interface
Login to router admin panel → Advanced Settings → Remote Management → Disable
Change default credentials
allUse strong unique passwords for router admin access
Login to router admin panel → System Tools → Modify Login Password
🧯 If You Can't Patch
- Replace affected routers with patched or different vendor models
- Place routers behind dedicated firewalls with strict inbound filtering rules
🔍 How to Verify
Check if Vulnerable:
Check router model and firmware version in admin interface under System Status or About page.Check Version:
curl -s http://router-ip/ | grep -i firmware || Check router web interfaceVerify Fix Applied:
Verify firmware version is updated beyond vulnerable versions listed in affected_systems.📡 Detection & Monitoring
Log Indicators:
- Multiple POST requests to /goform/setSpeedWan
- Router crash/reboot logs
- Unusual outbound connections from router
Network Indicators:
- Exploit traffic patterns to router management interface
- Sudden loss of router connectivity
SIEM Query:
source="router_logs" AND (uri="/goform/setSpeedWan" OR "speed_dir" in request_body)