CVE-2024-2489
📋 TL;DR
A critical stack-based buffer overflow vulnerability in Tenda AC18 routers allows remote attackers to execute arbitrary code by manipulating the 'list' argument in the formSetQosBand function. This affects Tenda AC18 routers running firmware version 15.03.05.05. Attackers can exploit this without authentication to potentially take full control of affected devices.
💻 Affected Systems
- Tenda AC18
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, creation of persistent backdoors, lateral movement to internal networks, and botnet enrollment.
Likely Case
Remote code execution allowing attackers to modify router settings, intercept network traffic, or use the device as a pivot point for further attacks.
If Mitigated
Limited impact if devices are behind firewalls with strict inbound filtering, though internal threats remain possible.
🎯 Exploit Status
Exploit code is publicly available on GitHub. The vulnerability requires sending a specially crafted HTTP request to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Vendor was contacted but did not respond. Consider workarounds or replacement.
🔧 Temporary Workarounds
Network Segmentation and Access Control
linuxRestrict access to the router's web interface using firewall rules to only trusted IP addresses.
iptables -A INPUT -p tcp --dport 80 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
Disable QoS Feature
allIf possible, disable the Quality of Service (QoS) feature that uses the vulnerable formSetQosBand function.
🧯 If You Can't Patch
- Replace affected Tenda AC18 routers with devices from vendors that provide security updates.
- Place routers behind a dedicated firewall that blocks all inbound traffic to the router's management interface.
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via web interface at http://router_ip/ or using command: curl -s http://router_ip/goform/GetDeviceInfo | grep firmwareCheck Version:
curl -s http://router_ip/goform/GetDeviceInfo | grep -o 'firmwareVersion":"[^"]*' | cut -d'"' -f3Verify Fix Applied:
No official fix available to verify. Verify workarounds by testing that the /goform/SetNetControlList endpoint is inaccessible from untrusted networks.📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP POST requests to /goform/SetNetControlList with large 'list' parameters
- Multiple failed buffer overflow attempts in router logs
Network Indicators:
- HTTP traffic to router IP on port 80/443 with unusually long POST data targeting /goform/SetNetControlList
SIEM Query:
source="router_logs" AND url="/goform/SetNetControlList" AND (post_data_size>1000 OR post_data CONTAINS "list=")