CVE-2023-50991
📋 TL;DR
A buffer overflow vulnerability in Tenda i29 routers allows remote attackers to cause denial of service by sending specially crafted requests to the pingSet function. This affects users running vulnerable firmware versions on Tenda i29 devices. The vulnerability is exploitable without authentication.
💻 Affected Systems
- Tenda i29
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, persistent backdoor installation, or bricking of the device requiring hardware replacement.
Likely Case
Denial of service causing router reboot or crash, disrupting network connectivity for all connected devices.
If Mitigated
Limited to denial of service with automatic recovery after reboot if exploit attempts are blocked at network perimeter.
🎯 Exploit Status
Public proof-of-concept demonstrates DoS exploitation. The buffer overflow nature suggests potential for RCE with additional research.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: No vendor advisory found
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates
2. Download latest firmware for i29 model
3. Access router web interface
4. Navigate to System Tools > Firmware Upgrade
5. Upload and apply new firmware
6. Wait for automatic reboot
🔧 Temporary Workarounds
Block web interface access
linuxRestrict access to router web management interface from untrusted networks
iptables -A INPUT -p tcp --dport 80 -s ! 192.168.0.0/16 -j DROP
iptables -A INPUT -p tcp --dport 443 -s ! 192.168.0.0/16 -j DROP
Disable remote management
allTurn off remote management feature in router settings
🧯 If You Can't Patch
- Isolate vulnerable routers in separate network segment with strict firewall rules
- Replace vulnerable devices with updated models or different vendor products
🔍 How to Verify
Check if Vulnerable:
Access router web interface > System Status > Firmware Version, check if version matches affected versionsCheck Version:
curl -s http://router-ip/ | grep -i firmware || wget -qO- http://router-ip/Verify Fix Applied:
Verify firmware version has changed from affected versions and test ping functionality works normally📡 Detection & Monitoring
Log Indicators:
- Multiple failed ping requests
- Router reboot events
- Web interface access with malformed pingIp parameter
Network Indicators:
- HTTP POST requests to /goform/pingSet with oversized pingIp parameter
- Sudden loss of router connectivity
SIEM Query:
source="router.log" AND ("pingSet" OR "pingIp") AND (content_length>100 OR status=500)