CVE-2024-2852
📋 TL;DR
A critical stack-based buffer overflow vulnerability in Tenda AC15 routers allows remote attackers to execute arbitrary code by manipulating the 'urls' parameter in the saveParentControlInfo function. This affects Tenda AC15 routers running firmware version 15.03.20_multi. Attackers can exploit this without authentication to potentially take full control of affected devices.
💻 Affected Systems
- Tenda AC15
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, creation of persistent backdoors, lateral movement to internal networks, and botnet recruitment.
Likely Case
Remote code execution allowing attackers to modify router settings, intercept network traffic, or use the device as a pivot point for further attacks.
If Mitigated
Limited impact if devices are behind firewalls with strict inbound filtering, though internal network exposure remains a risk.
🎯 Exploit Status
Public exploit details are available on GitHub. The vulnerability requires no authentication and has straightforward exploitation due to the buffer overflow.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available - vendor did not respond to disclosure
Restart Required: No
Instructions:
No official patch available. Consider workarounds or replacement if vendor does not provide updates.
🔧 Temporary Workarounds
Network Segmentation and Access Control
allIsolate Tenda AC15 routers in a separate VLAN with strict firewall rules blocking external access to the web interface (port 80/443).
Disable Remote Management
allEnsure remote management/administration is disabled on the router to prevent external exploitation.
🧯 If You Can't Patch
- Replace affected Tenda AC15 routers with devices from vendors that provide security updates
- Implement strict network segmentation and monitor for any suspicious traffic to/from the router
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via web interface at http://router_ip/ or via SSH if enabled. Look for version 15.03.20_multi.Check Version:
curl -s http://router_ip/ | grep -i 'firmware version' or login to web interface and check System StatusVerify Fix Applied:
No official fix available to verify. Monitor vendor website for firmware updates.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/saveParentControlInfo with long 'urls' parameters
- Router crash/reboot logs
- Unusual outbound connections from router
Network Indicators:
- HTTP POST requests to router_ip/goform/saveParentControlInfo with abnormally long parameters
- Sudden changes in router configuration or DNS settings
SIEM Query:
source="router_logs" AND (uri_path="/goform/saveParentControlInfo" AND content_length>1000) OR (event="device_reboot" AND source="tenda_ac15")🔗 References
- https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC15/V1.0%20V15.03.20_multi/saveParentControlInfo_urls.md
- https://vuldb.com/?ctiid.257776
- https://vuldb.com/?id.257776
- https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC15/V1.0%20V15.03.20_multi/saveParentControlInfo_urls.md
- https://vuldb.com/?ctiid.257776
- https://vuldb.com/?id.257776
