CVE-2024-2900
📋 TL;DR
This critical vulnerability in Tenda AC7 routers allows remote attackers to execute arbitrary code via a stack-based buffer overflow in the saveParentControlInfo function. Attackers can exploit this without authentication to potentially take full control of affected devices. All users of Tenda AC7 routers with firmware version 15.03.06.44 are affected.
💻 Affected Systems
- Tenda AC7
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing persistent remote access, credential theft, network pivoting, and botnet recruitment.
Likely Case
Remote code execution leading to device takeover, DNS hijacking, or man-in-the-middle attacks on network traffic.
If Mitigated
Limited impact if devices are behind firewalls with strict inbound filtering and network segmentation.
🎯 Exploit Status
Public exploit code exists in GitHub repositories. The vulnerability requires sending specially crafted HTTP requests to the router's web interface.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Vendor did not respond to disclosure. Consider replacing affected devices or implementing workarounds.
🔧 Temporary Workarounds
Disable Remote Management
allDisable web interface access from WAN/Internet to prevent remote exploitation
Access router admin interface > Advanced > System Tools > Remote Management > Disable
Network Segmentation
allIsolate router management interface to separate VLAN with strict access controls
🧯 If You Can't Patch
- Replace affected Tenda AC7 routers with different models from vendors with better security track records
- Implement strict network firewall rules blocking all inbound traffic to router management interfaces (ports 80, 443, 8080)
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface: Login > Advanced > System Tools > Firmware Upgrade > Current VersionCheck Version:
curl -s http://router-ip/goform/getStatus | grep versionVerify Fix Applied:
No fix available to verify. Monitor for firmware updates from Tenda.📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /goform/saveParentControlInfo with unusually long deviceId/time/urls parameters
- Router crash/reboot logs
Network Indicators:
- HTTP traffic to router IP on port 80 with POST to vulnerable endpoint
- Unusual outbound connections from router after exploitation
SIEM Query:
source="router_logs" AND (uri="/goform/saveParentControlInfo" AND (deviceId.length>100 OR time.length>100 OR urls.length>100))🔗 References
- https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC7/v1/saveParentControlInfo_deviceId.md
- https://vuldb.com/?ctiid.257943
- https://vuldb.com/?id.257943
- https://vuldb.com/?submit.300364
- https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC7/v1/saveParentControlInfo_deviceId.md
- https://vuldb.com/?ctiid.257943
- https://vuldb.com/?id.257943
- https://vuldb.com/?submit.300364
