CVE-2024-11056
📋 TL;DR
A critical stack-based buffer overflow vulnerability in Tenda AC10 routers allows remote attackers to execute arbitrary code by manipulating the wpapsk_crypto parameter. This affects Tenda AC10 routers running firmware version 16.03.10.13. Attackers can exploit this without authentication to potentially take full control of affected devices.
💻 Affected Systems
- Tenda AC10
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, creation of persistent backdoors, lateral movement to internal networks, and botnet enrollment.
Likely Case
Remote code execution allowing attackers to modify router settings, intercept network traffic, or use the device as a pivot point into internal networks.
If Mitigated
If properly segmented and monitored, impact limited to the router itself with no lateral movement to other systems.
🎯 Exploit Status
Public exploit details available; manipulation of wpapsk_crypto parameter triggers buffer overflow in FUN_0046AC38 function.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.tenda.com.cn/
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates. 2. Download latest firmware for AC10. 3. Log into router admin interface. 4. Navigate to firmware upgrade section. 5. Upload and apply new firmware. 6. Reboot router.
🔧 Temporary Workarounds
Disable WPS/WiFi Extra Features
allDisable WPS and WiFi extra settings that may use the vulnerable function
Network Segmentation
allIsolate router management interface from untrusted networks
🧯 If You Can't Patch
- Segment affected routers in isolated VLAN with strict firewall rules
- Implement network monitoring for exploitation attempts and block malicious IPs
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via admin interface; if version is 16.03.10.13, device is vulnerable.Check Version:
Login to router admin interface and check System Status or Firmware Version pageVerify Fix Applied:
After firmware update, verify version is no longer 16.03.10.13 and test if wpapsk_crypto parameter manipulation still causes issues.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/WifiExtraSet
- Multiple failed buffer overflow attempts in router logs
- Unexpected router reboots or configuration changes
Network Indicators:
- HTTP requests with manipulated wpapsk_crypto parameter
- Unusual outbound connections from router
- Traffic patterns suggesting router compromise
SIEM Query:
source="router_logs" AND (uri="/goform/WifiExtraSet" OR message="*buffer*" OR message="*overflow*")