CVE-2024-4245
📋 TL;DR
A critical stack-based buffer overflow vulnerability exists in Tenda i21 routers version 1.0.0.14(4656) affecting the formQosManageDouble_user function. Attackers can remotely exploit this by manipulating the ssidIndex parameter to execute arbitrary code or crash the device. This affects all users running the vulnerable firmware version.
💻 Affected Systems
- Tenda i21 router
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, persistent backdoor installation, and lateral movement to connected networks.
Likely Case
Device crash causing denial of service, potentially requiring physical reset or firmware reinstallation.
If Mitigated
Limited impact if device is behind firewall with restricted WAN access and proper network segmentation.
🎯 Exploit Status
Public proof-of-concept code exists on GitHub. Exploitation requires understanding of buffer overflow techniques but no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available - vendor did not respond to disclosure
Restart Required: Yes
Instructions:
No official patch available. Consider upgrading to newer firmware if available or replacing device.
🔧 Temporary Workarounds
Disable QoS Management
allDisable Quality of Service management features if possible to prevent access to vulnerable function
Network Segmentation
allIsolate router management interface from untrusted networks
🧯 If You Can't Patch
- Replace affected Tenda i21 routers with different models or brands
- Place router behind dedicated firewall with strict inbound rules blocking all unnecessary ports
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router web interface or via SSH: cat /proc/version or show version commandsCheck Version:
ssh admin@router-ip 'cat /proc/version' or check web interface at http://router-ipVerify Fix Applied:
Verify firmware version is no longer 1.0.0.14(4656) - no official fix available📡 Detection & Monitoring
Log Indicators:
- Unusual QoS configuration changes
- Repeated device crashes/reboots
- Buffer overflow error messages in system logs
Network Indicators:
- Unusual traffic to router management interface on port 80/443
- Exploit pattern matches in network traffic
SIEM Query:
source="router_logs" AND ("formQosManageDouble" OR "buffer overflow" OR "segmentation fault")🔗 References
- https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/i/i21/formQosManageDouble_auto.md
- https://vuldb.com/?ctiid.262136
- https://vuldb.com/?id.262136
- https://vuldb.com/?submit.319830
- https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/i/i21/formQosManageDouble_auto.md
- https://vuldb.com/?ctiid.262136
- https://vuldb.com/?id.262136
- https://vuldb.com/?submit.319830
