CVE-2023-45482
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on Tenda AC10 routers via a stack overflow in the get_parentControl_list_Info function. Attackers can exploit this by sending specially crafted requests to the vulnerable urls parameter. All users running the affected firmware version are at risk.
💻 Affected Systems
- Tenda AC10
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise leading to persistent backdoor installation, credential theft, and use as a pivot point into internal networks.
Likely Case
Remote code execution allowing attackers to modify router settings, intercept traffic, or launch attacks against other devices.
If Mitigated
Limited impact if device is behind firewall with restricted WAN access and network segmentation is implemented.
🎯 Exploit Status
Proof-of-concept code is publicly available in GitHub repositories. The vulnerability requires no authentication to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check Tenda's official website for firmware updates
2. If update available, download and flash via router admin interface
3. Factory reset after update to ensure clean configuration
🔧 Temporary Workarounds
Disable Parental Control Feature
allDisable the vulnerable parental control functionality that contains the affected code path
Restrict WAN Access
allConfigure firewall rules to block external access to router admin interface
🧯 If You Can't Patch
- Replace affected router with a different model or vendor
- Place router behind dedicated firewall with strict inbound filtering
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface. If version matches US_AC10V4.0si_V16.03.10.13_cn, device is vulnerable.Check Version:
Login to router admin interface and navigate to System Status or About pageVerify Fix Applied:
Verify firmware version has changed from vulnerable version after update. Test parental control functionality works without crashes.📡 Detection & Monitoring
Log Indicators:
- Unusual requests to parental control endpoints
- Router crash/reboot logs
- Memory corruption errors in system logs
Network Indicators:
- Unusual HTTP POST requests to router admin interface
- Traffic patterns suggesting exploit attempts
SIEM Query:
source="router_logs" AND ("get_parentControl_list_Info" OR "parental control" OR "urls parameter")🔗 References
- https://github.com/l3m0nade/IOTvul/blob/master/assets/get_parentControl_list_Info_code.png
- https://github.com/l3m0nade/IOTvul/blob/master/get_parentControl_list_Info.md
- https://github.com/l3m0nade/IOTvul/blob/master/assets/get_parentControl_list_Info_code.png
- https://github.com/l3m0nade/IOTvul/blob/master/get_parentControl_list_Info.md
