CVE-2024-2703
📋 TL;DR
A critical stack-based buffer overflow vulnerability in Tenda AC10U routers allows remote attackers to execute arbitrary code by manipulating the 'mac' parameter in the formSetDeviceName function. This affects Tenda AC10U routers running firmware version 15.03.06.49. Attackers can exploit this without authentication to potentially take full control of affected devices.
💻 Affected Systems
- Tenda AC10U
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, persistence installation, network pivoting, and botnet recruitment.
Likely Case
Device takeover enabling traffic interception, credential theft, DNS manipulation, and lateral movement within the network.
If Mitigated
Limited impact if devices are behind firewalls with strict inbound filtering and network segmentation.
🎯 Exploit Status
Public exploit details available on GitHub. The vulnerability requires sending a specially crafted HTTP request to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates. 2. If update available, download and install via web interface. 3. Reboot router after update. Note: Vendor has not responded to disclosure.
🔧 Temporary Workarounds
Disable Remote Management
allPrevent external access to router web interface
Access router admin panel → Advanced Settings → System Tools → Remote Management → Disable
Network Segmentation
allIsolate router management interface from untrusted networks
Configure firewall rules to block external access to port 80/443 on router IP
🧯 If You Can't Patch
- Replace affected devices with patched or alternative models
- Implement strict network access controls to limit exposure of management interfaces
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router web interface: Login → Advanced Settings → System Status → Firmware VersionCheck Version:
curl -s http://router-ip/goform/getStatus | grep versionVerify Fix Applied:
Verify firmware version is different from 15.03.06.49📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP POST requests to /goform/SetOnlineDevName
- Multiple failed buffer overflow attempts in system logs
- Unexpected device reboots or crashes
Network Indicators:
- HTTP requests with long mac parameters to router management interface
- Unusual outbound connections from router to unknown IPs
SIEM Query:
source="router_logs" AND (uri="/goform/SetOnlineDevName" OR (mac_parameter_length>50))🔗 References
- https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC10U/v1.V15.03.06.49/more/formSetDeviceName_mac.md
- https://vuldb.com/?ctiid.257454
- https://vuldb.com/?id.257454
- https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC10U/v1.V15.03.06.49/more/formSetDeviceName_mac.md
- https://vuldb.com/?ctiid.257454
- https://vuldb.com/?id.257454
