CVE-2024-30645
📋 TL;DR
This CVE describes a command injection vulnerability in Tenda AC15 routers where an attacker can execute arbitrary commands via the deviceName parameter. This allows remote code execution on affected devices, potentially compromising the entire network. Users of Tenda AC15 routers with firmware version V15.03.20_multi are affected.
💻 Affected Systems
- Tenda AC15
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the router leading to full network access, data exfiltration, installation of persistent backdoors, and use as a pivot point to attack other devices on the network.
Likely Case
Router takeover allowing network traffic interception, DNS hijacking, credential theft, and deployment of malware to connected devices.
If Mitigated
Limited impact with proper network segmentation, firewall rules, and monitoring detecting exploitation attempts.
🎯 Exploit Status
The vulnerability appears to be exploitable without authentication based on the CWE-78 classification and available references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: Yes
Instructions:
Check Tenda's official website for firmware updates. If available, download the latest firmware, log into router admin interface, navigate to firmware upgrade section, upload the new firmware file, and apply it.
🔧 Temporary Workarounds
Disable remote administration
allPrevent external access to router administration interface
Network segmentation
allIsolate router management interface to separate VLAN
🧯 If You Can't Patch
- Replace affected router with a different model that receives security updates
- Implement strict firewall rules to block all external access to router management interface
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface under System Status or Firmware Upgrade sectionCheck Version:
Log into router web interface and check firmware version in system settingsVerify Fix Applied:
Verify firmware version has been updated to a version newer than V15.03.20_multi📡 Detection & Monitoring
Log Indicators:
- Unusual command execution in router logs
- Multiple failed login attempts followed by successful access
- Changes to device name containing shell metacharacters
Network Indicators:
- Unusual outbound connections from router
- Traffic to known malicious IPs from router
- DNS queries to suspicious domains
SIEM Query:
source="router_logs" AND (deviceName CONTAINS ";" OR deviceName CONTAINS "|" OR deviceName CONTAINS "`" OR deviceName CONTAINS "$")