CVE-2024-10123 Overview
CVE-2024-10123 is a stack-based buffer overflow [CWE-121] in the Tenda AC8 router running firmware version 16.03.34.06. The flaw resides in the compare_parentcontrol_time function reachable through the /goform/saveParentControlInfo endpoint. Manipulating the time argument corrupts stack memory, enabling remote attackers with low privileges to execute arbitrary code or crash the device. The exploit has been publicly disclosed, and the vendor did not respond to disclosure attempts. This issue is distinct from CVE-2023-33671. The vulnerability affects a widely deployed consumer and small-office wireless router, exposing home and edge networks to remote compromise.
Critical Impact
Remote attackers can trigger a stack-based buffer overflow through the parental control web endpoint, leading to arbitrary code execution on the router and full compromise of the network edge.
Affected Products
- Tenda AC8 hardware revision 4.0
- Tenda AC8 firmware version 16.03.34.06
- Deployments exposing the /goform/saveParentControlInfo endpoint
Discovery Timeline
- 2024-10-18 - CVE-2024-10123 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-10123
Vulnerability Analysis
The vulnerability sits inside the compare_parentcontrol_time function invoked when the router processes parental-control schedule submissions. The web management interface exposes /goform/saveParentControlInfo and accepts a time parameter that encodes scheduling data. The function copies this attacker-controlled string into a fixed-size stack buffer without validating its length or format. Sending an oversized time value overwrites adjacent stack memory, including saved return addresses, corrupting control flow. Because the AC8 firmware runs its HTTP daemon with elevated privileges, successful exploitation yields code execution in that context. An attacker requires only authenticated access to the router UI, which is often protected by weak or default credentials on consumer devices.
Root Cause
The root cause is missing bounds checking on user-supplied input before it is copied into a stack-allocated buffer. The developer relied on unsafe string operations without enforcing length limits derived from the destination buffer size, a classic instance of [CWE-121]: Stack-based Buffer Overflow.
Attack Vector
Exploitation occurs over the network against the router's HTTP management interface. An attacker authenticated to the web UI submits a crafted POST request to /goform/saveParentControlInfo with an oversized time parameter. No user interaction is required beyond the attacker's own authenticated session. Where the management interface is exposed to the WAN, or reachable through cross-site request forgery from an attacker-controlled page, the attack surface expands significantly.
Technical write-up: GitHub Vulnerability Comparison. Additional entries: VulDB Entry #280915 and VulDB CTI Entry #280915.
Detection Methods for CVE-2024-10123
Indicators of Compromise
- HTTP POST requests to /goform/saveParentControlInfo containing abnormally long time parameter values.
- Unexpected reboots, watchdog resets, or httpd process crashes on Tenda AC8 devices.
- Outbound connections from the router to unfamiliar hosts following configuration changes.
- New or altered firewall, DNS, or parental-control settings that were not initiated by an administrator.
Detection Strategies
- Inspect HTTP traffic to the router management plane and alert on time parameters exceeding expected schedule string length.
- Correlate crash or restart events on the router with preceding administrative HTTP requests.
- Monitor for repeated authentication failures against the router UI, which often precede exploit attempts.
Monitoring Recommendations
- Forward router syslog data to a centralized logging platform and alert on httpd faults or segmentation events.
- Restrict access to the management interface to a dedicated management VLAN and monitor any traffic that reaches it from other segments.
- Track configuration drift on edge routers using periodic snapshots of DNS, firewall, and parental-control settings.
How to Mitigate CVE-2024-10123
Immediate Actions Required
- Disable remote WAN administration on the Tenda AC8 and restrict LAN-side management access to trusted hosts.
- Rotate the router administrator password and enforce a strong, unique credential.
- Disable the parental-control feature until a fixed firmware is available if the feature is not required.
- Segment the router management interface from user and IoT networks.
Patch Information
No vendor patch is available. According to the disclosure record, Tenda was contacted before public release and did not respond. Consult the Tenda Official Website for future firmware updates, and monitor VulDB Entry #280915 for status changes. Organizations should treat affected devices as end-of-support for security purposes until a fix is issued and consider replacement with a supported platform.
Workarounds
- Place the router behind an upstream firewall that restricts inbound access to the management interface.
- Disable the parental-control scheduling feature to remove the vulnerable code path from active use.
- Deploy network intrusion prevention rules that drop HTTP requests to /goform/saveParentControlInfo with oversized time parameters.
- Replace the affected device with a supported router where continued exposure is unacceptable.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
