CVE-2024-6402
📋 TL;DR
This critical vulnerability in Tenda A301 routers allows remote attackers to execute arbitrary code via a stack-based buffer overflow in the fromSetWirelessRepeat function. Attackers can exploit this by sending specially crafted requests to the /goform/SetOnlineDevName endpoint, potentially taking full control of affected devices. All users running Tenda A301 firmware version 15.13.08.12 are affected.
💻 Affected Systems
- Tenda A301
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise leading to persistent remote access, network infiltration, data exfiltration, and use as a botnet node.
Likely Case
Remote code execution allowing attackers to modify router settings, intercept network traffic, or deploy malware.
If Mitigated
Limited impact if devices are behind firewalls with strict inbound filtering and network segmentation.
🎯 Exploit Status
Exploit details are publicly available on GitHub, making weaponization straightforward for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Vendor was contacted but did not respond. Consider replacing affected devices.
🔧 Temporary Workarounds
Disable Remote Management
allDisable web management interface access from WAN/Internet
Network Segmentation
allIsolate affected routers in separate VLANs with strict firewall rules
🧯 If You Can't Patch
- Replace affected Tenda A301 routers with devices from vendors providing security updates
- Implement strict network access controls to limit exposure of router management interfaces
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via web interface at 192.168.0.1 or using command: telnet [router_ip] (if enabled)Check Version:
Check web interface at http://[router_ip]/goform/getStatus or login to admin panelVerify Fix Applied:
No fix available to verify. Monitor for firmware updates from Tenda.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/SetOnlineDevName
- Multiple failed authentication attempts followed by buffer overflow patterns
Network Indicators:
- Unusual outbound connections from router
- Traffic spikes to/from router management port
SIEM Query:
source_ip="router_ip" AND (url_path="/goform/SetOnlineDevName" OR http_method="POST" AND user_agent_contains="exploit")🔗 References
- https://github.com/General-Offensive/iot_vuldb/blob/main/Tenda/A301/formSetDeviceName_devName.md
- https://vuldb.com/?ctiid.269947
- https://vuldb.com/?id.269947
- https://vuldb.com/?submit.360696
- https://github.com/General-Offensive/iot_vuldb/blob/main/Tenda/A301/formSetDeviceName_devName.md
- https://vuldb.com/?ctiid.269947
- https://vuldb.com/?id.269947
- https://vuldb.com/?submit.360696
