CVE-2024-7151
📋 TL;DR
This critical vulnerability in Tenda O3 routers allows remote attackers to execute arbitrary code via a stack-based buffer overflow in the MAC filter configuration function. Attackers can exploit this to take full control of affected devices. All users running Tenda O3 firmware version 1.0.0.10(2478) are affected.
💻 Affected Systems
- Tenda O3 router
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, persistent backdoor installation, network traffic interception, and lateral movement to other devices on the network.
Likely Case
Device takeover enabling attackers to modify router settings, intercept network traffic, deploy malware, or use the device as part of a botnet.
If Mitigated
Limited impact if devices are behind firewalls with strict inbound filtering, though internal network compromise remains possible if exploited.
🎯 Exploit Status
Public exploit code is available on GitHub. The vulnerability requires no authentication and has straightforward exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available - vendor did not respond to disclosure
Restart Required: Yes
Instructions:
No official patch available. Consider replacing affected devices or implementing strict network controls.
🔧 Temporary Workarounds
Disable remote management
allDisable web management interface access from WAN/Internet
Access router admin panel → Advanced Settings → Remote Management → Disable
Network segmentation
allIsolate Tenda O3 routers in separate VLAN with strict firewall rules
🧯 If You Can't Patch
- Replace affected Tenda O3 routers with patched or different vendor devices
- Implement strict network access controls: block all inbound traffic to router management interface, allow only from trusted management networks
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via admin interface: Login → System Status → Firmware VersionCheck Version:
Check via web interface or SSH if enabled: cat /proc/version or show version commandsVerify Fix Applied:
Verify firmware version is no longer 1.0.0.10(2478). Since no patch exists, replacement is the only fix verification.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/setMacFilter with long remark parameters
- Router crash/restart logs
- Unusual configuration changes to MAC filtering
Network Indicators:
- Exploit traffic patterns to router management interface (typically port 80/443)
- Unusual outbound connections from router after compromise
SIEM Query:
source_ip="router_ip" AND (url_path="/goform/setMacFilter" OR http_method="POST" AND user_agent_contains="exploit")🔗 References
- https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/O3v2.0/fromMacFilterSet.md
- https://vuldb.com/?ctiid.272554
- https://vuldb.com/?id.272554
- https://vuldb.com/?submit.377040
- https://github.com/noahze01/IoT-vulnerable/blob/main/Tenda/O3v2.0/fromMacFilterSet.md
- https://vuldb.com/?ctiid.272554
- https://vuldb.com/?id.272554
- https://vuldb.com/?submit.377040
