CVE-2024-0992
📋 TL;DR
A critical stack-based buffer overflow vulnerability exists in Tenda i6 routers version 1.0.0.9(3857). Remote attackers can exploit this via the HTTP interface to potentially execute arbitrary code or crash the device. This affects all users running the vulnerable firmware.
💻 Affected Systems
- Tenda i6 router
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, router takeover, credential theft, and lateral movement into connected networks.
Likely Case
Device crash causing denial of service, potentially requiring physical reset and disrupting network connectivity.
If Mitigated
Limited impact if device is behind firewall with restricted HTTP access, though still vulnerable to internal threats.
🎯 Exploit Status
Exploit details are publicly disclosed. The vulnerability requires no authentication and has straightforward exploitation path.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: Yes
Instructions:
No official patch available. Vendor was contacted but did not respond. Consider replacing affected devices or implementing workarounds.
🔧 Temporary Workarounds
Disable HTTP management interface
allDisable the web management interface or restrict access to trusted IPs only
Access router admin panel → System Tools → Remote Management → Disable or restrict IP range
Change default management port
allChange HTTP management port from default 80 to non-standard port
Access router admin panel → System Tools → Remote Management → Change HTTP port
🧯 If You Can't Patch
- Isolate affected routers in separate network segment with strict firewall rules
- Implement network monitoring for exploitation attempts and device crashes
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via admin panel: Login → System Status → Firmware VersionCheck Version:
Check web interface at http://router-ip or use router admin panelVerify Fix Applied:
No fix available to verify. Monitor for device stability and absence of crashes.📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /goform/wifiSSIDset with abnormal parameters
- Device crash/reboot logs
- Unusual process creation
Network Indicators:
- HTTP POST requests to /goform/wifiSSIDset with long index parameter
- Sudden loss of router connectivity
SIEM Query:
http.url:"/goform/wifiSSIDset" AND http.method:POST AND (http.request.body:*index=* OR http.request.body.length>100)🔗 References
- https://jylsec.notion.site/Tenda-i6-has-stack-buffer-overflow-vulnerability-in-formwrlSSIDset-f0e8be2eb0614e03a60160b48f8527f5?pvs=4
- https://vuldb.com/?ctiid.252257
- https://vuldb.com/?id.252257
- https://jylsec.notion.site/Tenda-i6-has-stack-buffer-overflow-vulnerability-in-formwrlSSIDset-f0e8be2eb0614e03a60160b48f8527f5?pvs=4
- https://vuldb.com/?ctiid.252257
- https://vuldb.com/?id.252257
