CVE-2024-4239
📋 TL;DR
A critical stack-based buffer overflow vulnerability in Tenda AX1806 routers allows remote attackers to execute arbitrary code by manipulating the rebootTime parameter. This affects Tenda AX1806 routers running firmware version 1.0.0.1. The vulnerability is remotely exploitable without authentication.
💻 Affected Systems
- Tenda AX1806
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, persistence, lateral movement, and botnet recruitment.
Likely Case
Device takeover, credential theft, DNS hijacking, and network surveillance.
If Mitigated
Denial of service or device crash if exploit fails or is blocked.
🎯 Exploit Status
Exploit details are publicly available on GitHub. The vulnerability requires no authentication and has a simple exploitation path.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: Yes
Instructions:
No official patch available. Contact Tenda support for firmware updates. If update becomes available, download from official Tenda website and flash via web interface.
🔧 Temporary Workarounds
Disable remote management
allDisable remote administration features to prevent external exploitation.
Access router web interface > Advanced > System Tools > Remote Management > Disable
Network segmentation
allIsolate affected routers in separate VLANs to limit lateral movement.
🧯 If You Can't Patch
- Replace affected routers with different models or brands
- Implement strict network access controls to limit traffic to router management interfaces
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via web interface: Login > Advanced > System Tools > Firmware Upgrade. If version is 1.0.0.1, device is vulnerable.Check Version:
curl -s http://router-ip/goform/getStatus | grep versionVerify Fix Applied:
Verify firmware version is no longer 1.0.0.1. Test if /goform/SetRebootTimer endpoint still accepts malformed rebootTime parameter.📡 Detection & Monitoring
Log Indicators:
- Multiple POST requests to /goform/SetRebootTimer with long rebootTime parameters
- Device reboot logs following suspicious requests
Network Indicators:
- Unusual outbound connections from router
- DNS queries to suspicious domains
- Traffic patterns indicating command and control
SIEM Query:
source="router_logs" AND (url="/goform/SetRebootTimer" AND content_length>100) OR (event="reboot" AND source_ip!=local_admin)🔗 References
- https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AX/AX1806/formSetRebootTimer.md
- https://vuldb.com/?ctiid.262130
- https://vuldb.com/?id.262130
- https://vuldb.com/?submit.319235
- https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AX/AX1806/formSetRebootTimer.md
- https://vuldb.com/?ctiid.262130
- https://vuldb.com/?id.262130
- https://vuldb.com/?submit.319235
