CVE-2024-10123
📋 TL;DR
A critical stack-based buffer overflow vulnerability in Tenda AC8 routers allows remote attackers to execute arbitrary code by manipulating the 'time' parameter in the compare_parentcontrol_time function. This affects Tenda AC8 routers running firmware version 16.03.34.06. Attackers can exploit this without authentication to potentially take full control of affected devices.
💻 Affected Systems
- Tenda AC8
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, creation of persistent backdoors, lateral movement to internal networks, and data exfiltration.
Likely Case
Remote attackers gain shell access to the router, enabling them to modify configurations, intercept traffic, or use the device as a pivot point for further attacks.
If Mitigated
If network segmentation and strict firewall rules are in place, impact may be limited to the router itself without allowing lateral movement.
🎯 Exploit Status
Public exploit code is available on GitHub. The vulnerability requires sending a specially crafted HTTP request to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.tenda.com.cn/
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates. 2. If update available, download and install via router web interface. 3. Reboot router after installation. Note: Vendor has not responded to disclosure, so patches may not be available.
🔧 Temporary Workarounds
Disable Parent Control Feature
allDisable the parent control functionality that uses the vulnerable endpoint
Access router web interface > Parental Controls > Disable
Block External Access
linuxConfigure firewall to block external access to router administration interface
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Isolate affected routers in separate network segments with strict firewall rules
- Implement network monitoring for exploitation attempts and unusual traffic patterns
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in web interface: Login > System Status > Firmware Version. If version is 16.03.34.06, device is vulnerable.Check Version:
curl -s http://router-ip/goform/getStatus | grep versionVerify Fix Applied:
Verify firmware version has changed from 16.03.34.06 to a newer version. Test if /goform/saveParentControlInfo endpoint still accepts malformed time parameters.📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /goform/saveParentControlInfo with unusually long time parameter
- Router crash/reboot logs
- Unusual process execution in router logs
Network Indicators:
- HTTP requests with oversized time parameter values
- Multiple failed exploitation attempts to the vulnerable endpoint
- Unusual outbound connections from router
SIEM Query:
source="router_logs" AND (url="/goform/saveParentControlInfo" AND content_length>100) OR (process="crash" AND device="router")