CVE-2024-10697
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary commands on Tenda AC6 routers by injecting malicious commands into the 'mac' parameter of the formWriteFacMac API endpoint. Attackers can take full control of affected devices without authentication. Only Tenda AC6 routers running firmware version 15.03.05.19 are affected.
💻 Affected Systems
- Tenda AC6
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of router with ability to pivot to internal network, intercept/modify traffic, install persistent malware, or use as botnet node.
Likely Case
Router takeover leading to DNS hijacking, credential theft from network traffic, or deployment of cryptocurrency miners.
If Mitigated
Limited impact if router is behind firewall with restricted API access, though still vulnerable to internal threats.
🎯 Exploit Status
Public exploit code available; exploitation requires simple HTTP POST request with command injection payload.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.tenda.com.cn/
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates
2. Download latest firmware for AC6
3. Upload via router admin interface
4. Reboot router after update
🔧 Temporary Workarounds
Block API Endpoint Access
linuxRestrict access to vulnerable /goform/WriteFacMac endpoint using firewall rules
iptables -A INPUT -p tcp --dport 80 -m string --string "/goform/WriteFacMac" --algo bm -j DROP
iptables -A INPUT -p tcp --dport 443 -m string --string "/goform/WriteFacMac" --algo bm -j DROP
Disable Remote Management
allTurn off WAN access to router admin interface
🧯 If You Can't Patch
- Replace affected Tenda AC6 routers with different models/brands
- Place routers behind dedicated firewall with strict inbound filtering
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface; if version is 15.03.05.19, device is vulnerable.Check Version:
curl -s http://router-ip/goform/getStatus | grep versionVerify Fix Applied:
Verify firmware version has changed from 15.03.05.19 to newer version after update.📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /goform/WriteFacMac with unusual mac parameter values
- Router logs showing unexpected command execution
Network Indicators:
- Unusual outbound connections from router IP
- DNS queries to suspicious domains from router
SIEM Query:
source="router_logs" AND uri_path="/goform/WriteFacMac" AND (mac="*;*" OR mac="*|*" OR mac="*`*")