CVE-2024-2805
📋 TL;DR
A critical stack-based buffer overflow vulnerability in Tenda AC15 routers allows remote attackers to execute arbitrary code by manipulating the speed_dir parameter in the formSetSpeedWan function. This affects Tenda AC15 routers running firmware versions 15.03.05.18 and 15.03.20_multi. Attackers can exploit this without authentication to potentially take full control of affected devices.
💻 Affected Systems
- Tenda AC15
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, creation of persistent backdoors, lateral movement to internal networks, and botnet recruitment.
Likely Case
Device takeover for credential theft, DNS hijacking, man-in-the-middle attacks, or participation in DDoS botnets.
If Mitigated
Denial of service if exploit fails or limited impact with proper network segmentation and monitoring.
🎯 Exploit Status
Public exploit code is available, and the vulnerability requires minimal technical skill to exploit due to the straightforward buffer overflow.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: Yes
Instructions:
No official patch available. Contact Tenda support for firmware updates. If unavailable, implement workarounds immediately.
🔧 Temporary Workarounds
Disable Remote Management
allDisable web management interface access from WAN/internet to prevent remote exploitation.
Access router admin panel → Advanced Settings → System Tools → Remote Management → Disable
Network Segmentation
linuxIsolate router management interface to dedicated VLAN or restrict access to trusted IPs only.
iptables -A INPUT -p tcp --dport 80 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
🧯 If You Can't Patch
- Replace affected routers with patched or different models
- Implement strict network monitoring and intrusion detection for exploit attempts
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin panel: Login → Advanced Settings → System Status → Firmware VersionCheck Version:
curl -s http://router-ip/goform/getStatus | grep versionVerify Fix Applied:
Verify firmware version is updated beyond affected versions (if patch becomes available) or confirm remote management is disabled.📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /goform/SetSpeedWan with long speed_dir parameters
- Router crash/reboot logs
Network Indicators:
- Unusual outbound connections from router
- Exploit traffic patterns to router port 80
SIEM Query:
source="router_logs" AND url="/goform/SetSpeedWan" AND post_data CONTAINS "speed_dir=" AND length(post_data) > 100🔗 References
- https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC15/V1.0%20V15.03.20_multi/SetSpeedWan.md
- https://vuldb.com/?ctiid.257660
- https://vuldb.com/?id.257660
- https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC15/V1.0%20V15.03.20_multi/SetSpeedWan.md
- https://vuldb.com/?ctiid.257660
- https://vuldb.com/?id.257660
