CVE-2024-36604
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary commands with root privileges on Tenda O3V2 routers via a blind command injection in the stpEn parameter. Attackers can gain complete control of affected devices. Only Tenda O3V2 routers running specific vulnerable firmware are affected.
💻 Affected Systems
- Tenda O3V2
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full device compromise allowing attackers to install persistent backdoors, pivot to internal networks, intercept all network traffic, or brick the device.
Likely Case
Attackers gain root shell access to execute commands, potentially installing malware, creating backdoors, or using the device for botnet activities.
If Mitigated
With proper network segmentation and access controls, impact limited to the router itself without lateral movement to other systems.
🎯 Exploit Status
The vulnerability is well-documented with technical details available. Exploitation requires sending crafted requests to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: No
Instructions:
Check Tenda's official website for firmware updates. If available, download and flash the latest firmware through the router's web interface.
🔧 Temporary Workarounds
Disable STP Service
allDisable the Spanning Tree Protocol service if not required for network operations
Network Segmentation
allIsolate the router's management interface from untrusted networks
🧯 If You Can't Patch
- Replace affected devices with patched or alternative hardware
- Implement strict network access controls to limit exposure to the management interface
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router web interface under System Status or similar section. If version is v1.0.0.12(3880), device is vulnerable.Check Version:
Login to router web interface and navigate to System Status pageVerify Fix Applied:
After updating firmware, verify the version is newer than v1.0.0.12(3880) and test the STP service endpoint.📡 Detection & Monitoring
Log Indicators:
- Unusual command execution in system logs
- Multiple failed authentication attempts to STP service
- Suspicious network traffic to router management port
Network Indicators:
- Unusual outbound connections from router
- Traffic patterns indicating command and control communication
- Port scanning originating from router
SIEM Query:
source="router_logs" AND ("stpEn" OR "SetStp") AND command="*"