CVE-2024-57575
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on Tenda AC18 routers by exploiting a stack overflow in the WiFi configuration function. Attackers can gain full control of affected devices without authentication. All users running the vulnerable firmware version are affected.
💻 Affected Systems
- Tenda AC18
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete router compromise leading to persistent backdoor installation, credential theft, network traffic interception, and lateral movement to connected devices.
Likely Case
Router takeover enabling DNS hijacking, credential harvesting, and use as a pivot point for attacking internal network devices.
If Mitigated
Limited impact if device is behind firewall with strict inbound filtering, though internal network exposure remains.
🎯 Exploit Status
Public GitHub repository contains proof-of-concept code demonstrating the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates. 2. If update available, download and install via router admin interface. 3. Reboot router after installation.
🔧 Temporary Workarounds
Disable remote administration
allPrevents external attackers from accessing the vulnerable interface
Login to router admin > Advanced > System Tools > Remote Management > Disable
Change default admin credentials
allReduces risk of unauthorized access
Login to router admin > Advanced > System Tools > Password > Set strong password
🧯 If You Can't Patch
- Replace affected router with different model/brand
- Place router behind dedicated firewall with strict inbound filtering
🔍 How to Verify
Check if Vulnerable:
Login to router admin interface and check firmware version under Advanced > System Tools > Firmware UpgradeCheck Version:
Not applicable - check via web interfaceVerify Fix Applied:
Verify firmware version is newer than V15.03.05.19📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/fast_setting_wifi_set
- Multiple failed login attempts followed by successful access
- Router configuration changes without authorized user action
Network Indicators:
- Unusual outbound connections from router
- DNS queries to suspicious domains
- Port scans originating from router
SIEM Query:
source="router_logs" AND (uri="/goform/fast_setting_wifi_set" OR event="configuration_change")