CVE-2024-11248
📋 TL;DR
A critical stack-based buffer overflow vulnerability in Tenda AC10 routers allows remote attackers to execute arbitrary code by manipulating the rebootTime parameter. This affects Tenda AC10 routers running firmware version 16.03.10.13. Successful exploitation could lead to complete device compromise.
💻 Affected Systems
- Tenda AC10
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to full router compromise, credential theft, network pivoting, and persistent backdoor installation.
Likely Case
Router crash/reboot causing denial of service, followed by potential remote code execution for attackers with exploit development skills.
If Mitigated
Limited to denial of service if exploit fails or if network segmentation prevents lateral movement.
🎯 Exploit Status
Exploit details have been publicly disclosed, making weaponization likely. The vulnerability is remotely exploitable without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.tenda.com.cn/
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates. 2. Download latest firmware for AC10. 3. Log into router admin interface. 4. Navigate to firmware upgrade section. 5. Upload and apply new firmware. 6. Reboot router.
🔧 Temporary Workarounds
Disable remote management
allPrevent external access to router management interface
Network segmentation
allIsolate router management interface to trusted network segment
🧯 If You Can't Patch
- Replace affected routers with patched or different vendor models
- Implement strict network access controls to limit exposure to router management interface
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface. If version is 16.03.10.13, device is vulnerable.Check Version:
Check via router web interface at 192.168.0.1 or 192.168.1.1 (default) under System Status or similar section.Verify Fix Applied:
Verify firmware version has changed from 16.03.10.13 to a newer version after update.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/SetSysAutoRebbotCfg with long rebootTime parameters
- Router crash/reboot logs
Network Indicators:
- HTTP POST requests to router IP on port 80/443 targeting vulnerable endpoint
- Unusual outbound connections from router
SIEM Query:
http.method:POST AND http.uri:"/goform/SetSysAutoRebbotCfg" AND http.param.rebootTime:*