CVE-2024-10130 Overview
CVE-2024-10130 is a stack-based buffer overflow [CWE-121] in the Tenda AC8 router running firmware version 16.03.34.06. The vulnerability resides in the formSetRebootTimer function handling requests to /goform/SetSysAutoRebbotCfg. Manipulation of the rebootTime argument overflows a stack buffer, corrupting saved return state on the device. The flaw is reachable over the network and requires only low-privileged access to the router's web interface. The disclosure notes the vendor was contacted but did not respond, and technical details have been published publicly.
Critical Impact
Remote attackers with low privileges can trigger memory corruption in the Tenda AC8 web server, enabling denial of service and potential arbitrary code execution on affected routers.
Affected Products
- Tenda AC8 router hardware, version 4.0
- Tenda AC8 firmware version 16.03.34.06
- Deployments exposing the router administrative interface to untrusted networks
Discovery Timeline
- 2024-10-18 - CVE-2024-10130 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-10130
Vulnerability Analysis
The vulnerability is a classic stack-based buffer overflow in the router's HTTP configuration handler. The formSetRebootTimer function processes the SetSysAutoRebbotCfg endpoint, which configures the router's automatic reboot schedule. Attacker-controlled input from the rebootTime HTTP parameter is copied into a fixed-size stack buffer without length validation. Because the copy operation lacks bounds checking, an oversized value overwrites adjacent stack memory, including the saved return address of the calling function.
Once control-flow data on the stack is corrupted, the process either crashes or transfers execution to attacker-influenced memory. On MIPS-based Tenda devices, similar patterns have historically enabled remote code execution via ROP chains targeting the httpd process, which typically runs with root privileges. See the GitHub vulnerability report for the disassembly and offset analysis.
Root Cause
The root cause is missing input length validation in formSetRebootTimer. The function trusts the length of the rebootTime parameter supplied through the web management interface and writes it into a stack allocation without sanity checks. This mirrors a broader pattern of unsafe strcpy-style operations in Tenda AC-series firmware.
Attack Vector
Exploitation requires network reachability to the router's HTTP administration service and an authenticated session at low privilege. An attacker submits a crafted POST request to /goform/SetSysAutoRebbotCfg with an oversized rebootTime value. The malformed request overflows the buffer during processing, leading to a controllable crash or code execution within the router's httpd context.
No verified exploitation code is included here. Technical writeups are available in the VulDB entry and the research report.
Detection Methods for CVE-2024-10130
Indicators of Compromise
- HTTP POST requests to /goform/SetSysAutoRebbotCfg containing unusually long rebootTime values, particularly exceeding typical numeric length
- Unexpected reboots or httpd crashes on Tenda AC8 devices correlated with inbound management-interface traffic
- Outbound connections from the router to unfamiliar hosts following administrative request bursts
Detection Strategies
- Inspect HTTP traffic to the router management interface for oversized parameter values on /goform/ endpoints
- Alert on repeated administrative authentication followed by requests to reboot-scheduling endpoints from a single source
- Monitor router availability and log any repeated httpd restarts characteristic of memory corruption exploitation attempts
Monitoring Recommendations
- Restrict router management access to a dedicated administrative VLAN and log all connections to it
- Forward router syslog output to a centralized log platform for correlation with network telemetry
- Baseline normal administrative request patterns and flag deviations in parameter length or endpoint frequency
How to Mitigate CVE-2024-10130
Immediate Actions Required
- Disable remote WAN-side management of the Tenda AC8 and expose the web interface only on trusted LAN segments
- Change the router administrative password and audit accounts that could reach /goform/SetSysAutoRebbotCfg
- Segment the router from sensitive internal networks and monitor egress traffic sourced from the device
- Plan migration off firmware 16.03.34.06, as the vendor has not publicly responded to the disclosure
Patch Information
At the time of publication, no vendor patch has been published. The disclosure record notes that Tenda was contacted early but did not respond. Consult the Tenda official website periodically for firmware updates addressing CVE-2024-10130 and refer to VulDB entry #280918 for status changes.
Workarounds
- Block external access to the router's HTTP administration port at the perimeter firewall or ISP-provided gateway
- Restrict source addresses permitted to reach /goform/ endpoints using ACLs on upstream network devices
- Replace end-of-life or unpatched Tenda AC8 units with a supported router platform where feasible
- Enforce strong administrative credentials to raise the barrier to the low-privilege access the exploit requires
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
