CVE-2024-10280
📋 TL;DR
A null pointer dereference vulnerability in Tenda routers allows remote attackers to cause denial of service by manipulating the Content-Length argument in the websReadEvent function. This affects multiple Tenda AC series router models up to October 22, 2024. Attackers can exploit this remotely without authentication to crash the router's web service.
💻 Affected Systems
- Tenda AC6
- Tenda AC7
- Tenda AC8
- Tenda AC9
- Tenda AC10
- Tenda AC10U
- Tenda AC15
- Tenda AC18
- Tenda AC500
- Tenda AC1206
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Router becomes completely unresponsive requiring physical reboot, potentially disrupting all network connectivity for connected devices.
Likely Case
Web management interface becomes unavailable, requiring router reboot to restore functionality.
If Mitigated
Minimal impact if routers are behind firewalls with restricted WAN access to management interfaces.
🎯 Exploit Status
Public exploit code is available, making exploitation straightforward for attackers with basic skills.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.tenda.com.cn/
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates. 2. Download latest firmware for your model. 3. Access router web interface. 4. Navigate to firmware upgrade section. 5. Upload and install new firmware. 6. Reboot router after installation.
🔧 Temporary Workarounds
Disable Remote Management
allPrevent external access to router management interface
Restrict Management Interface Access
allLimit access to router web interface to trusted IP addresses only
🧯 If You Can't Patch
- Place routers behind firewalls with strict inbound rules blocking access to port 80/443
- Implement network segmentation to isolate routers from untrusted networks
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in web interface under System Status or About page. If version date is 20241022 or earlier, router is vulnerable.Check Version:
No CLI command available. Must check via web interface at http://router-ip/ or router admin panel.Verify Fix Applied:
After firmware update, verify version shows date later than 20241022 and test web interface functionality remains stable.📡 Detection & Monitoring
Log Indicators:
- Multiple connection attempts to /goform/GetIPTV
- Web service crash logs
- Router reboot events without user action
Network Indicators:
- HTTP requests with manipulated Content-Length headers to router IP
- Sudden loss of connectivity to router management interface
SIEM Query:
source="router_logs" AND (uri="/goform/GetIPTV" OR event="web_service_crash")