CVE-2023-48109
📋 TL;DR
This vulnerability in Tenda AX1803 routers allows attackers to trigger a heap overflow via the deviceId parameter in the saveParentControlInfo function. Attackers can exploit this to cause a Denial of Service (DoS) by crashing the router's web interface or potentially executing arbitrary code. Only users running Tenda AX1803 v1.0.0.1 are affected.
💻 Affected Systems
- Tenda AX1803
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete router compromise, credential theft, and network infiltration
Likely Case
Denial of Service causing router reboot or web interface crash, disrupting network connectivity
If Mitigated
Limited impact if router is behind firewall with restricted web interface access
🎯 Exploit Status
Exploitation requires access to the web management interface and knowledge of the vulnerable endpoint
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: No vendor advisory found
Restart Required: No
Instructions:
Check Tenda's official website for firmware updates. If available, download and flash the latest firmware through the router's web interface.
🔧 Temporary Workarounds
Disable web management interface
allDisable remote access to router's web management interface
Access router settings → Administration → Remote Management → Disable
Restrict web interface access
allLimit web interface access to specific IP addresses only
Access router settings → Security → Access Control → Add allowed IPs
🧯 If You Can't Patch
- Replace affected router with a different model or vendor
- Place router behind a firewall that blocks access to port 80/443 on the router
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in web interface: Login → System Tools → Firmware UpgradeCheck Version:
Check router web interface or use: curl -s http://router-ip/status | grep versionVerify Fix Applied:
Verify firmware version is no longer v1.0.0.1 after update📡 Detection & Monitoring
Log Indicators:
- Multiple failed POST requests to /goform/saveParentControlInfo
- Router reboot logs
- Web interface crash logs
Network Indicators:
- Unusual POST requests to router IP on port 80/443 with long deviceId parameters
- Router becoming unresponsive
SIEM Query:
source="router.log" AND (uri_path="/goform/saveParentControlInfo" OR message="heap overflow" OR message="segmentation fault")