CVE-2024-11056 Overview
CVE-2024-11056 is a stack-based buffer overflow vulnerability in the Tenda AC10 router running firmware version 16.03.10.13. The flaw resides in the FUN_0046AC38 function within the /goform/WifiExtraSet handler. Attackers manipulate the wpapsk_crypto argument to overflow a fixed-size stack buffer. The vulnerability is remotely exploitable over the network and public exploit details have been disclosed. The weakness is classified under CWE-119, improper restriction of operations within the bounds of a memory buffer.
Critical Impact
Remote attackers with low-privilege access can trigger a stack overflow in the router web management interface, leading to arbitrary code execution or device crash on affected Tenda AC10 devices.
Affected Products
- Tenda AC10 router (hardware version 4.0)
- Tenda AC10 firmware version 16.03.10.13
- Web management endpoint /goform/WifiExtraSet
Discovery Timeline
- 2024-11-10 - CVE-2024-11056 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-11056
Vulnerability Analysis
The vulnerability exists in the HTTP request handler for the /goform/WifiExtraSet endpoint, which processes Wi-Fi extended configuration parameters. When the router web server receives a request containing the wpapsk_crypto parameter, it passes the attacker-controlled value into the FUN_0046AC38 function without validating length or bounds. The function copies the input into a fixed-size stack buffer, allowing an attacker to overwrite adjacent stack memory including the saved return address.
Successful exploitation can hijack control flow on the MIPS-based device, resulting in arbitrary code execution in the context of the web server process. This process typically runs with elevated privileges on consumer routers, granting the attacker full control of network traffic, DNS resolution, and administrative functions. Public technical analysis of the overflow is available through the Notion Stack Overflow Analysis and VulDB entry #283800.
Root Cause
The root cause is the absence of length validation on the wpapsk_crypto request parameter before it is copied into a stack-allocated buffer inside FUN_0046AC38. Unsafe string handling functions perform an unbounded copy operation, permitting overflow of the buffer boundary and corruption of the saved frame pointer and return address.
Attack Vector
Exploitation requires network reachability to the router web management interface and low-privilege authenticated access. An attacker crafts an HTTP POST request to /goform/WifiExtraSet with an oversized wpapsk_crypto value. The attack does not require user interaction and can be automated. The vulnerability increases risk in environments where the router management interface is exposed on the WAN or reachable from untrusted LAN segments.
No verified exploit code is included here. Refer to the Notion technical analysis for reverse-engineering details of the vulnerable function.
Detection Methods for CVE-2024-11056
Indicators of Compromise
- HTTP POST requests to /goform/WifiExtraSet containing abnormally long wpapsk_crypto parameter values
- Unexpected reboots, watchdog resets, or crashes of the Tenda AC10 web management process
- Outbound connections from the router to unknown hosts following administrative HTTP activity
- Modifications to router DNS, DHCP, or firewall configuration outside change windows
Detection Strategies
- Inspect HTTP traffic destined to router management interfaces for oversized POST parameters targeting /goform/ endpoints
- Deploy network intrusion detection signatures that match wpapsk_crypto values exceeding expected WPA passphrase length (63 characters)
- Correlate router availability drops with preceding HTTP requests to the management interface
Monitoring Recommendations
- Log and forward router administrative access events to a centralized SIEM for correlation
- Monitor for unauthorized access attempts to the router web UI from untrusted network segments
- Alert on repeated malformed HTTP requests targeting /goform/WifiExtraSet or similar administrative handlers
How to Mitigate CVE-2024-11056
Immediate Actions Required
- Restrict access to the Tenda AC10 web management interface to trusted management VLANs only
- Disable remote WAN-side management on the router configuration if enabled
- Rotate router administrator credentials and enforce strong passwords to raise the bar for the low-privilege prerequisite
- Segment the affected device from sensitive network zones until a firmware update is available
Patch Information
At the time of publication, no vendor security advisory or firmware update addressing CVE-2024-11056 has been published in the referenced sources. Monitor the Tenda official website for firmware releases superseding version 16.03.10.13. Organizations should consider replacing end-of-support hardware with actively maintained models if a fix is not released.
Workarounds
- Place the router behind an upstream firewall that filters inbound HTTP requests to management endpoints
- Use an ACL to permit /goform/WifiExtraSet access only from a dedicated administrative host
- Disable Wi-Fi extended configuration features through the UI where operationally feasible to reduce parameter exposure
- Review whether the device can be replaced with vendor-supported hardware that receives timely security updates
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
