CVE-2024-6189
📋 TL;DR
A critical stack-based buffer overflow vulnerability in Tenda A301 routers allows remote attackers to execute arbitrary code by manipulating the wpapsk_crypto parameter. This affects users running Tenda A301 firmware version 15.13.08.12. Successful exploitation could lead to complete device compromise.
💻 Affected Systems
- Tenda A301
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to full router compromise, credential theft, network pivoting, and persistent backdoor installation.
Likely Case
Router takeover enabling traffic interception, DNS manipulation, and network disruption.
If Mitigated
Limited impact if device is behind firewall with restricted WAN access and strong network segmentation.
🎯 Exploit Status
Exploit details are publicly disclosed. The vulnerability requires no authentication and has a straightforward exploitation path.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available - vendor did not respond to disclosure
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates
2. If update available, download and flash via web interface
3. Factory reset after update
4. Reconfigure with secure settings
🔧 Temporary Workarounds
Disable Remote Management
allPrevent external access to router web interface
Access router settings > Security > Disable Remote Management/Web Access from WAN
Network Segmentation
allIsolate router management interface from user networks
Create separate VLAN for management traffic
Configure firewall rules to restrict access to router IP
🧯 If You Can't Patch
- Replace affected router with supported model from different vendor
- Place router behind dedicated firewall with strict inbound rules blocking all access to router management interface
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in web interface: Login > System Status > Firmware VersionCheck Version:
curl -s http://router-ip/goform/GetSysInfo | grep firmware_versionVerify Fix Applied:
Verify firmware version is different from 15.13.08.12 and no longer vulnerable📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/WifiExtraSet
- Multiple failed buffer overflow attempts in system logs
- Abnormal process crashes or restarts
Network Indicators:
- Unusual traffic patterns to router management interface
- Suspicious payloads in HTTP requests containing buffer overflow patterns
SIEM Query:
source="router_logs" AND (url="/goform/WifiExtraSet" OR message="*wpapsk_crypto*" OR message="*buffer overflow*")🔗 References
- https://military-hail-377.notion.site/Tenda-A301V2-0-stack-overflow-c95f23f03b2b4eb5b8ffd3912e9982fd
- https://vuldb.com/?ctiid.269160
- https://vuldb.com/?id.269160
- https://vuldb.com/?submit.355264
- https://military-hail-377.notion.site/Tenda-A301V2-0-stack-overflow-c95f23f03b2b4eb5b8ffd3912e9982fd
- https://vuldb.com/?ctiid.269160
- https://vuldb.com/?id.269160
- https://vuldb.com/?submit.355264
