CVE-2024-2811
📋 TL;DR
This critical vulnerability in Tenda AC15 routers allows remote attackers to execute arbitrary code via a stack-based buffer overflow in the WPS configuration function. Attackers can exploit this to take full control of affected devices. Only Tenda AC15 routers running firmware version 15.03.20_multi are affected.
💻 Affected Systems
- Tenda AC15
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, persistent backdoor installation, and lateral movement into internal networks.
Likely Case
Router takeover enabling traffic interception, credential theft, and use as botnet node for DDoS attacks.
If Mitigated
Limited impact if devices are behind firewalls with strict inbound filtering and network segmentation.
🎯 Exploit Status
Public exploit code exists in GitHub repositories. The vulnerability requires no authentication and has straightforward exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available - vendor did not respond to disclosure
Restart Required: Yes
Instructions:
No official patch available. Consider replacing affected devices or implementing strict network controls.
🔧 Temporary Workarounds
Disable WPS and Web Management
allDisable WPS functionality and restrict web management interface access
Router-specific: Disable WPS in wireless settings
Router-specific: Change web management to LAN-only or disable
Network Segmentation and Firewall Rules
linuxIsolate routers and block external access to management interfaces
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Immediately isolate affected routers in separate VLAN with strict firewall rules
- Disable remote management and restrict web interface to internal trusted networks only
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via web interface at 192.168.0.1 or 192.168.1.1, look for version 15.03.20_multiCheck Version:
curl -s http://router-ip/ | grep -i 'firmware version' or check web interface System Status pageVerify Fix Applied:
No official fix available. Verify workarounds by confirming WPS is disabled and management interface is not accessible from untrusted networks.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/WifiWpsStart
- Multiple failed buffer overflow attempts in system logs
- Sudden configuration changes without admin action
Network Indicators:
- Unexpected outbound connections from router
- Traffic patterns suggesting device compromise
- Port scanning originating from router
SIEM Query:
source="router_logs" AND (url="/goform/WifiWpsStart" OR message="buffer overflow" OR message="segmentation fault")🔗 References
- https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC15/V1.0%20V15.03.20_multi/formWifiWpsStart.md
- https://vuldb.com/?ctiid.257666
- https://vuldb.com/?id.257666
- https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC15/V1.0%20V15.03.20_multi/formWifiWpsStart.md
- https://vuldb.com/?ctiid.257666
- https://vuldb.com/?id.257666
