CVE-2023-45484
📋 TL;DR
This vulnerability is a stack overflow in Tenda AC10 routers via the shareSpeed parameter in the fromSetWifiGuestBasic function. It allows remote attackers to execute arbitrary code or cause denial of service. Affects users of Tenda AC10 routers with the vulnerable firmware version.
💻 Affected Systems
- Tenda AC10
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to full router compromise, credential theft, network pivoting, and persistent backdoor installation.
Likely Case
Router crash causing denial of service, requiring physical reset and temporary network disruption.
If Mitigated
Limited impact if network segmentation isolates routers and external access is restricted.
🎯 Exploit Status
Exploit details and proof-of-concept code are publicly available in GitHub repositories. Authentication is required to access the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates. 2. Download latest firmware for AC10. 3. Log into router admin interface. 4. Navigate to firmware upgrade section. 5. Upload and apply new firmware. 6. Reboot router.
🔧 Temporary Workarounds
Disable Guest WiFi
allDisable the guest WiFi functionality to remove the vulnerable endpoint.
Restrict Admin Access
allChange router admin interface to only allow access from specific IP addresses.
🧯 If You Can't Patch
- Segment router on isolated network segment with strict firewall rules
- Disable remote administration and WAN access to admin interface
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface under System Status or Firmware Upgrade page.Check Version:
Login to router web interface and check firmware version in system settings.Verify Fix Applied:
Verify firmware version has changed from US_AC10V4.0si_V16.03.10.13_cn to a newer version.📡 Detection & Monitoring
Log Indicators:
- Multiple failed authentication attempts followed by successful login and POST requests to /goform/setWifiGuestBasic
Network Indicators:
- Unusual outbound connections from router, unexpected firmware modification attempts
SIEM Query:
source="router_logs" AND (uri_path="/goform/setWifiGuestBasic" OR process="fromSetWifiGuestBasic")🔗 References
- https://github.com/l3m0nade/IOTvul/blob/master/assets/fromSetWifiGuestBasic_code.png
- https://github.com/l3m0nade/IOTvul/blob/master/fromSetWifiGusetBasic.md
- https://github.com/l3m0nade/IOTvul/blob/master/assets/fromSetWifiGuestBasic_code.png
- https://github.com/l3m0nade/IOTvul/blob/master/fromSetWifiGusetBasic.md
