CVE-2024-4164
📋 TL;DR
This critical vulnerability in Tenda G3 routers allows remote attackers to execute arbitrary code via a stack-based buffer overflow in the PPP authentication whitelist management function. Attackers can exploit this to take full control of affected routers. All users running vulnerable firmware versions are affected.
💻 Affected Systems
- Tenda G3 router
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise leading to persistent backdoor installation, network traffic interception, lateral movement to connected devices, and botnet recruitment.
Likely Case
Remote code execution allowing attackers to modify router settings, intercept traffic, or use the device as a pivot point for further attacks.
If Mitigated
Limited impact if devices are behind firewalls with strict inbound filtering, though internal network compromise remains possible.
🎯 Exploit Status
Exploit details are publicly available on GitHub, making exploitation straightforward for attackers with basic skills.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: Yes
Instructions:
No official patch available. Monitor Tenda website for firmware updates. If update becomes available: 1. Download firmware from official Tenda site 2. Log into router admin interface 3. Navigate to firmware upgrade section 4. Upload and apply new firmware 5. Reboot router
🔧 Temporary Workarounds
Disable remote management
allPrevent external access to the vulnerable web interface
Log into router admin → System → Remote Management → Disable
Network segmentation
allIsolate Tenda G3 routers from critical network segments
🧯 If You Can't Patch
- Replace affected routers with different models from vendors providing security updates
- Implement strict network access controls to limit traffic to router management interface
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via admin interface: System → Firmware Upgrade → Current VersionCheck Version:
Check via web interface or attempt to access /goform/ModifyPppAuthWhiteMac with monitoringVerify Fix Applied:
Verify firmware version is no longer 15.11.0.17(9502) and no newer vulnerable version📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/ModifyPppAuthWhiteMac
- Router reboot events following web interface access
- Configuration changes to PPP authentication settings
Network Indicators:
- HTTP requests with unusually long pppoeServerWhiteMacIndex parameter values
- Traffic to router management interface from unexpected sources
SIEM Query:
http.url:"/goform/ModifyPppAuthWhiteMac" AND http.method:POST🔗 References
- https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/G3/G3V15/formModifyPppAuthWhiteMac.md
- https://vuldb.com/?ctiid.261983
- https://vuldb.com/?id.261983
- https://vuldb.com/?submit.318588
- https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/G3/G3V15/formModifyPppAuthWhiteMac.md
- https://vuldb.com/?ctiid.261983
- https://vuldb.com/?id.261983
- https://vuldb.com/?submit.318588
