CVE-2024-10280 Overview
CVE-2024-10280 is a null pointer dereference vulnerability [CWE-476] affecting multiple Tenda AC-series wireless routers up to firmware version 20241022. The flaw resides in the websReadEvent function within the /goform/GetIPTV endpoint, where manipulation of the HTTP Content-Length header triggers a null pointer dereference. Attackers can exploit this remotely to cause a denial of service against affected devices. The exploit details have been publicly disclosed, increasing the risk of opportunistic exploitation against exposed devices. The affected product line spans ten different Tenda AC router models widely deployed in home and small-office environments.
Critical Impact
Remote attackers with low privileges can crash the router's web service by sending a crafted HTTP request to /goform/GetIPTV, resulting in a denial of service condition on affected Tenda AC devices.
Affected Products
- Tenda AC6, AC7, AC8, AC9, AC10, AC10U routers (multiple firmware revisions)
- Tenda AC15, AC18, AC500, AC1206 routers (multiple firmware revisions)
- All firmware versions up to and including build dated 20241022
Discovery Timeline
- 2024-10-23 - CVE-2024-10280 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-10280
Vulnerability Analysis
The vulnerability affects the websReadEvent function, which handles inbound HTTP requests directed at the /goform/GetIPTV endpoint on the router's embedded web server. When processing the request, the function reads and acts upon the Content-Length header without sufficient validation of the resulting pointer. A crafted or malformed Content-Length value causes the function to dereference a null pointer during request handling. The dereference crashes the web server process and can render the router's management interface, and in some cases device services, unavailable until reboot. Because the endpoint is reachable over the network, the attack does not require physical access or user interaction on the target device.
Root Cause
The root cause is classified as CWE-476: NULL Pointer Dereference. The websReadEvent handler does not validate that an internal buffer or structure pointer, derived from or gated by the Content-Length header, is non-null before use. When the attacker supplies an unexpected value, the code path continues without allocating or populating the required object, and the subsequent dereference terminates the process.
Attack Vector
The attack vector is network-based and requires low privileges on the router's HTTP interface. An attacker sends a specially crafted HTTP request to /goform/GetIPTV containing a manipulated Content-Length header. The malformed request reaches websReadEvent, triggers the null dereference, and crashes the web service. Public technical documentation of the flaw is available in the GitHub advisory for websReadEvent and the VulDB entry #281555.
No verified proof-of-concept code is included here. Refer to the linked technical references for exploitation details.
Detection Methods for CVE-2024-10280
Indicators of Compromise
- Unexpected crashes or restarts of the router's httpd/web management process
- Repeated HTTP POST or GET requests to /goform/GetIPTV from external or unusual internal sources
- Requests to /goform/GetIPTV containing malformed, oversized, or otherwise anomalous Content-Length header values
Detection Strategies
- Inspect network traffic for HTTP requests targeting the /goform/GetIPTV URI on Tenda devices and flag anomalous Content-Length headers
- Correlate router availability drops or management-interface outages with preceding inbound HTTP requests to affected endpoints
- Deploy IDS/IPS signatures that identify malformed requests to Tenda /goform/* handlers
Monitoring Recommendations
- Enable and centralize syslog forwarding from Tenda routers to detect repeated service restarts
- Alert on any Internet-sourced HTTP traffic reaching the router's WAN-side management port
- Track exposure of Tenda router management interfaces through periodic external attack-surface scans
How to Mitigate CVE-2024-10280
Immediate Actions Required
- Restrict access to the router's web management interface to trusted LAN segments only and disable remote (WAN) administration
- Verify that /goform/GetIPTV is not reachable from untrusted networks by testing external exposure
- Monitor the Tenda official website for firmware updates addressing this issue
Patch Information
At the time of publication, no vendor advisory or patched firmware release has been referenced in the NVD entry for CVE-2024-10280. Administrators should track the Tenda support portal for updated firmware and apply it to all affected AC-series models once available.
Workarounds
- Disable the IPTV feature on the router if it is not required in the deployment
- Place vulnerable routers behind an upstream firewall that filters unsolicited inbound HTTP traffic
- Replace end-of-life Tenda AC models with actively supported hardware where firmware fixes are unlikely to be released
# Example: block external access to the router management interface at an upstream firewall
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -j DROP
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
