CVE-2024-11650
📋 TL;DR
A critical null pointer dereference vulnerability in Tenda i9 routers allows remote attackers to crash the device or potentially execute arbitrary code by sending specially crafted requests to the /goform/GetIPTV endpoint. This affects Tenda i9 router firmware version 1.0.0.8(3828). Attackers can exploit this without authentication from the network.
💻 Affected Systems
- Tenda i9 router
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, router configuration modification, credential theft, and lateral movement into internal networks.
Likely Case
Denial of service causing router crash and network disruption, requiring physical reset to restore functionality.
If Mitigated
Limited impact if device is behind firewall with restricted WAN access, though internal attackers could still exploit.
🎯 Exploit Status
Public exploit code is available on GitHub, making exploitation trivial for attackers with basic skills.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.tenda.com.cn/
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates. 2. Download latest firmware. 3. Access router admin interface. 4. Navigate to firmware upgrade section. 5. Upload and apply new firmware. 6. Wait for router to reboot.
🔧 Temporary Workarounds
Network Segmentation
allIsolate Tenda i9 routers from untrusted networks and restrict access to management interfaces.
Access Control Lists
linuxImplement firewall rules to block external access to port 80/443 and internal access to /goform/ endpoints.
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Replace vulnerable Tenda i9 routers with supported, patched alternatives from different vendors.
- Implement strict network monitoring and anomaly detection for traffic to router management interfaces.
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface. If version is exactly 1.0.0.8(3828), device is vulnerable.Check Version:
Check via router web interface at http://router_ip or use nmap scan for banner grabbing.Verify Fix Applied:
Verify firmware version has changed from 1.0.0.8(3828) to a newer version after update.📡 Detection & Monitoring
Log Indicators:
- Repeated requests to /goform/GetIPTV endpoint
- Router crash/reboot events
- Unusual outbound connections from router
Network Indicators:
- HTTP POST requests to /goform/GetIPTV with malformed parameters
- Sudden loss of connectivity to router
SIEM Query:
source="router_logs" AND (uri="/goform/GetIPTV" OR event="crash" OR event="reboot")