CVE-2024-50854
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on Tenda G3 routers via a stack overflow in the formSetPortMapping function. Attackers can gain full control of affected devices, potentially compromising network security. All users running vulnerable firmware versions are affected.
💻 Affected Systems
- Tenda G3
📦 What is this software?
G3 Firmware by Tendacn
⚠️ Risk & Real-World Impact
Worst Case
Complete device takeover leading to persistent backdoor installation, network traffic interception, lateral movement to other devices, and use as botnet node.
Likely Case
Remote code execution allowing attacker to modify router settings, intercept traffic, or deploy malware on connected devices.
If Mitigated
Limited impact if device is behind firewall with strict inbound rules and port forwarding disabled.
🎯 Exploit Status
Exploit details and proof-of-concept code are publicly available on GitHub. Authentication to router web interface is required for exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates. 2. Download latest firmware for G3 model. 3. Log into router web interface. 4. Navigate to System Tools > Firmware Upgrade. 5. Upload and install new firmware. 6. Reboot router.
🔧 Temporary Workarounds
Disable Remote Management
allPrevent external access to router web interface
Restrict Access to Management Interface
allLimit which devices can access router admin panel
🧯 If You Can't Patch
- Isolate router on separate VLAN with strict firewall rules
- Disable port forwarding functionality entirely
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in web interface under System Status or System ToolsCheck Version:
Not applicable - check via web interfaceVerify Fix Applied:
Verify firmware version is newer than 15.11.0.20📡 Detection & Monitoring
Log Indicators:
- Multiple failed authentication attempts followed by successful login
- Unusual port forwarding rule changes
- Large POST requests to formSetPortMapping endpoint
Network Indicators:
- Unusual outbound connections from router
- Traffic to known malicious IPs from router
- Port scanning originating from router
SIEM Query:
source_ip=router_ip AND (uri_path="/goform/setPortMapping" OR user_agent_contains="curl" OR content_length>10000)