CVE-2024-2487
📋 TL;DR
This critical vulnerability in Tenda AC18 routers allows remote attackers to execute arbitrary code via a stack-based buffer overflow in the formSetDeviceName function. Attackers can exploit this by sending specially crafted requests to the /goform/SetOnlineDevName endpoint. All users running the affected firmware version are at risk.
💻 Affected Systems
- Tenda AC18
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, persistence, and potential lateral movement to connected networks.
Likely Case
Remote code execution allowing attackers to install malware, create backdoors, or use the device as part of a botnet.
If Mitigated
Limited impact if device is behind firewall with restricted WAN access and proper network segmentation.
🎯 Exploit Status
Public exploit code is available, making exploitation straightforward for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: Yes
Instructions:
No official patch available. Vendor was contacted but did not respond. Consider replacing or isolating affected devices.
🔧 Temporary Workarounds
Network Isolation
allPlace affected routers behind firewalls with strict inbound rules
Access Restriction
linuxBlock access to /goform/SetOnlineDevName endpoint
iptables -A INPUT -p tcp --dport 80 -m string --string "/goform/SetOnlineDevName" --algo bm -j DROP
🧯 If You Can't Patch
- Immediately disconnect affected devices from internet-facing networks
- Replace affected devices with supported alternatives from different vendors
🔍 How to Verify
Check if Vulnerable:
Check router web interface or SSH/Telnet for firmware version 15.03.05.05Check Version:
Check router admin interface at http://[router-ip]/ or use telnet/ssh if enabledVerify Fix Applied:
Verify firmware version has been updated to a version later than 15.03.05.05📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/SetOnlineDevName
- Large devName parameter values in web logs
Network Indicators:
- HTTP POST requests to /goform/SetOnlineDevName with oversized payloads
- Unusual outbound connections from router
SIEM Query:
source="router-logs" AND uri_path="/goform/SetOnlineDevName" AND content_length>100🔗 References
- https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC18/formSetDeviceName_devName.md
- https://vuldb.com/?ctiid.256894
- https://vuldb.com/?id.256894
- https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC18/formSetDeviceName_devName.md
- https://vuldb.com/?ctiid.256894
- https://vuldb.com/?id.256894
