CVE-2024-2705
📋 TL;DR
A critical stack-based buffer overflow vulnerability in Tenda AC10U routers allows remote attackers to execute arbitrary code by manipulating the 'list' argument in the formSetQosBand function. This affects Tenda AC10U routers running firmware versions 1.0 through 15.03.06.49. The vulnerability is remotely exploitable without authentication.
💻 Affected Systems
- Tenda AC10U
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, persistence installation, network pivoting, and data exfiltration.
Likely Case
Router takeover enabling traffic interception, DNS manipulation, credential theft, and botnet recruitment.
If Mitigated
Limited impact if device is behind firewall with restricted WAN access and proper network segmentation.
🎯 Exploit Status
Public exploit details available on GitHub. The vulnerability requires sending a specially crafted HTTP request to the /goform/SetNetControlList endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available - vendor did not respond to disclosure
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates 2. If update available, download and install via web interface 3. Factory reset after update 4. Reconfigure with secure settings
🔧 Temporary Workarounds
Disable Remote Management
allPrevent external access to router management interface
Access router web interface -> Advanced -> System Tools -> Remote Management -> Disable
Network Segmentation
allIsolate router management interface to trusted network segment
Configure firewall rules to restrict access to router IP on ports 80/443
🧯 If You Can't Patch
- Replace affected routers with supported models from different vendors
- Implement strict network access controls to limit exposure of router management interface
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router web interface: Login -> Advanced -> System Tools -> Firmware UpgradeCheck Version:
curl -s http://router-ip/goform/getStatus | grep versionVerify Fix Applied:
Verify firmware version is newer than 15.03.06.49 or from different vendor📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP POST requests to /goform/SetNetControlList
- Multiple failed buffer overflow attempts in system logs
Network Indicators:
- HTTP traffic to router IP with unusually long 'list' parameter values
- Suspicious payloads in POST requests
SIEM Query:
source="router_logs" AND (uri="/goform/SetNetControlList" AND method="POST" AND size>1024)🔗 References
- https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC10U/v1.V15.03.06.49/more/formSetQosBand.md
- https://vuldb.com/?ctiid.257456
- https://vuldb.com/?id.257456
- https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC10U/v1.V15.03.06.49/more/formSetQosBand.md
- https://vuldb.com/?ctiid.257456
- https://vuldb.com/?id.257456
