CVE-2024-2855
📋 TL;DR
A critical stack-based buffer overflow vulnerability in Tenda AC15 routers allows remote attackers to execute arbitrary code by manipulating the 'time' parameter in the fromSetSysTime function. This affects Tenda AC15 routers running firmware versions 15.03.05.18, 15.03.05.19, and 15.03.20. Attackers can exploit this without authentication to potentially take full control of affected devices.
💻 Affected Systems
- Tenda AC15
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, creation of persistent backdoors, lateral movement to internal networks, and botnet recruitment.
Likely Case
Device takeover enabling traffic interception, DNS hijacking, credential theft, and use as attack platform against internal networks.
If Mitigated
Limited impact if devices are behind firewalls with strict inbound filtering and network segmentation.
🎯 Exploit Status
Public exploit code exists in GitHub repositories. The vulnerability requires no authentication and has straightforward exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: Yes
Instructions:
No official patch available. Vendor was contacted but did not respond. Consider replacing affected devices or implementing workarounds.
🔧 Temporary Workarounds
Disable Remote Management
allDisable web management interface access from WAN/Internet
Access router admin panel > Advanced > System Tools > Remote Management > Disable
Restrict Management Access
allLimit management interface access to specific trusted IP addresses only
Access router admin panel > Advanced > Security > Access Control > Add trusted IP ranges
🧯 If You Can't Patch
- Segment affected routers on isolated network VLANs
- Implement strict firewall rules blocking all inbound traffic to router management ports (typically 80, 443, 8080)
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router web interface: Login > Advanced > System Status > Firmware VersionCheck Version:
curl -s http://router-ip/goform/getStatus | grep version (if API accessible)Verify Fix Applied:
Verify firmware version is NOT 15.03.05.18, 15.03.05.19, or 15.03.20. No official patch exists.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/SetSysTimeCfg
- Multiple failed buffer overflow attempts in system logs
- Unexpected process crashes or reboots
Network Indicators:
- Unusual outbound connections from router to unknown IPs
- Traffic spikes to router management interface
- DNS queries to suspicious domains from router
SIEM Query:
source="router_logs" AND (uri="/goform/SetSysTimeCfg" OR message="buffer overflow" OR message="segmentation fault")🔗 References
- https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC15/V1.0%20V15.03.20_multi/fromSetSysTime.md
- https://vuldb.com/?ctiid.257779
- https://vuldb.com/?id.257779
- https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC15/V1.0%20V15.03.20_multi/fromSetSysTime.md
- https://vuldb.com/?ctiid.257779
- https://vuldb.com/?id.257779
