CVE-2024-10351
📋 TL;DR
A critical stack-based buffer overflow vulnerability in Tenda RX9 Pro routers allows remote attackers to execute arbitrary code by sending specially crafted POST requests to the /goform/setMacFilterCfg endpoint. This affects users running firmware version 22.03.02.20. Successful exploitation could lead to complete device compromise.
💻 Affected Systems
- Tenda RX9 Pro
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to full router compromise, credential theft, network traffic interception, and lateral movement into connected networks.
Likely Case
Router takeover allowing attackers to modify DNS settings, intercept traffic, or deploy malware to connected devices.
If Mitigated
Limited impact if device is behind firewall with restricted WAN access or if exploit attempts are blocked by network security controls.
🎯 Exploit Status
Exploit details have been publicly disclosed on Gitee. The vulnerability requires no authentication and manipulation of the deviceList parameter triggers the buffer overflow.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.tenda.com.cn/
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates 2. Download latest firmware 3. Access router admin interface 4. Navigate to firmware upgrade section 5. Upload and apply new firmware 6. Reboot router
🔧 Temporary Workarounds
Disable Remote Management
allPrevent external access to router web interface
Access router admin panel -> Advanced Settings -> Remote Management -> Disable
Block Access to Vulnerable Endpoint
allUse firewall rules to block access to /goform/setMacFilterCfg
iptables -A INPUT -p tcp --dport 80 -m string --string "/goform/setMacFilterCfg" --algo bm -j DROP
iptables -A INPUT -p tcp --dport 443 -m string --string "/goform/setMacFilterCfg" --algo bm -j DROP
🧯 If You Can't Patch
- Replace affected router with different model or vendor
- Place router behind dedicated firewall with strict inbound rules
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface. If version is 22.03.02.20, device is vulnerable.Check Version:
curl -s http://router-ip/ | grep -i firmware or check web interface System Status pageVerify Fix Applied:
After firmware update, verify version is newer than 22.03.02.20 in router admin panel.📡 Detection & Monitoring
Log Indicators:
- Multiple POST requests to /goform/setMacFilterCfg with long deviceList parameters
- Router reboot events following suspicious requests
- Unusual outbound connections from router
Network Indicators:
- HTTP POST requests to router IP on port 80/443 with deviceList parameter exceeding normal length
- Traffic patterns suggesting router compromise (DNS changes, unexpected outbound connections)
SIEM Query:
source="router_logs" AND (uri_path="/goform/setMacFilterCfg" AND http_method="POST" AND content_length>500)