CVE-2024-0990
📋 TL;DR
A critical stack-based buffer overflow vulnerability in Tenda i6 routers allows remote attackers to execute arbitrary code by sending specially crafted requests to the /goform/setAutoPing endpoint. This affects Tenda i6 router version 1.0.0.9(3857) with the vulnerable httpd component exposed. Attackers can exploit this without authentication to potentially take full control of affected devices.
💻 Affected Systems
- Tenda i6
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, persistence installation, network pivoting, and data exfiltration.
Likely Case
Device takeover enabling traffic interception, DNS hijacking, or botnet recruitment.
If Mitigated
Denial of service or limited impact if network segmentation and access controls prevent exploitation.
🎯 Exploit Status
Public exploit details are available, and the vulnerability requires no authentication, making weaponization highly probable.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available - vendor did not respond to disclosure
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates. 2. If update available, download and install via router web interface. 3. Reboot router after installation. Note: No vendor patch is currently known.
🔧 Temporary Workarounds
Disable remote management
allPrevent external access to the vulnerable httpd service by disabling remote management features.
Access router web interface > Advanced Settings > Remote Management > Disable
Network segmentation
allIsolate Tenda i6 routers from untrusted networks and restrict access to management interface.
Configure firewall rules to block external access to router IP on port 80/443
🧯 If You Can't Patch
- Replace affected Tenda i6 routers with different models from vendors providing security updates
- Implement strict network access controls allowing only trusted IPs to access router management interface
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via web interface: Login > System Status > Firmware Version. If version is 1.0.0.9(3857), device is vulnerable.Check Version:
curl -s http://router-ip/ | grep -i 'firmware' or check web interface directlyVerify Fix Applied:
Verify firmware version has changed from 1.0.0.9(3857) to a newer version after update.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/setAutoPing with long ping1 parameters
- Router crash/restart logs
- Unusual outbound connections from router
Network Indicators:
- Exploit traffic patterns to router port 80/443 with specific buffer overflow payloads
- Sudden changes in router behavior or configuration
SIEM Query:
source="router_logs" AND (url="/goform/setAutoPing" AND parameter_length>100) OR (event="buffer_overflow" AND device="Tenda i6")🔗 References
- https://jylsec.notion.site/Tenda-i6-has-stack-buffer-overflow-vulnerability-in-formSetAutoPing-2e009d81eb7e45438565d5ba6794f4e3?pvs=4
- https://vuldb.com/?ctiid.252255
- https://vuldb.com/?id.252255
- https://jylsec.notion.site/Tenda-i6-has-stack-buffer-overflow-vulnerability-in-formSetAutoPing-2e009d81eb7e45438565d5ba6794f4e3?pvs=4
- https://vuldb.com/?ctiid.252255
- https://vuldb.com/?id.252255
