CVE-2024-11061 Overview
CVE-2024-11061 is a stack-based buffer overflow in the Tenda AC10 router firmware version 16.03.10.13. The flaw resides in the function FUN_0044db3c, which processes requests to the /goform/fast_setting_wifi_set endpoint. Attackers can trigger the overflow by manipulating the timeZone argument in a crafted HTTP request. The vulnerability is remotely exploitable and the exploit details have been publicly disclosed. The weakness maps to [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer).
Critical Impact
Remote attackers with low-privileged access can overflow a stack buffer in the Tenda AC10 web management interface, potentially achieving arbitrary code execution on the router.
Affected Products
- Tenda AC10 hardware revision 4.0
- Tenda AC10 firmware version 16.03.10.13
- Web management interface handler /goform/fast_setting_wifi_set
Discovery Timeline
- 2024-11-11 - CVE-2024-11061 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-11061
Vulnerability Analysis
The Tenda AC10 router exposes a web-based configuration interface that handles wireless setup requests through the /goform/fast_setting_wifi_set endpoint. The internal handler function FUN_0044db3c processes user-supplied parameters including the timeZone field. The function copies this attacker-controlled input into a fixed-size stack buffer without validating the input length. Sending an oversized timeZone value overwrites adjacent stack memory, including the saved return address.
Attackers can leverage this overflow to redirect execution flow on the MIPS-based router. Successful exploitation typically yields code execution in the context of the web management daemon, which runs with elevated privileges on embedded Tenda firmware. This provides an attacker with full control over router configuration, traffic inspection, and pivoting into the internal network.
Root Cause
The root cause is the absence of bounds checking when copying the timeZone parameter into a stack-allocated buffer inside FUN_0044db3c. The function trusts client-supplied length and content, using unsafe string operations that write past the buffer boundary. This is a classic [CWE-119] memory safety failure common in consumer router firmware.
Attack Vector
Exploitation requires network access to the router's HTTP management interface and low-privileged authentication. An attacker sends a POST request to /goform/fast_setting_wifi_set containing an oversized timeZone parameter. Because the interface is often reachable from the LAN by default, a compromised device on the local network or a cross-site request forgery chain could reach the vulnerable endpoint. Technical details are documented in the Notion research write-up on Tenda AC10v4 and VulDB Entry #283807.
No verified proof-of-concept code is included here. Refer to the referenced advisories for reproduction details.
Detection Methods for CVE-2024-11061
Indicators of Compromise
- HTTP POST requests to /goform/fast_setting_wifi_set with abnormally long timeZone parameter values.
- Unexpected reboots, service crashes, or watchdog resets of the Tenda AC10 web management daemon (httpd).
- Outbound connections from the router to unknown hosts following configuration changes.
- New or altered firewall, DNS, or routing rules that were not made by an administrator.
Detection Strategies
- Inspect HTTP request logs from the router or upstream network devices for requests targeting /goform/fast_setting_wifi_set with parameter lengths exceeding normal timezone strings.
- Deploy network intrusion detection signatures that flag oversized timeZone values in Tenda goform HTTP requests.
- Correlate router crash events with preceding HTTP requests to identify exploitation attempts.
Monitoring Recommendations
- Baseline normal administrative traffic to the router's management interface and alert on anomalous request patterns.
- Monitor for unauthorized access attempts against router management endpoints from unexpected internal hosts.
- Track firmware version and configuration integrity to detect post-exploitation persistence.
How to Mitigate CVE-2024-11061
Immediate Actions Required
- Restrict access to the router's web management interface to trusted management VLANs or specific administrative hosts.
- Disable remote (WAN-side) management on the Tenda AC10 if it is enabled.
- Rotate the router administrator password and audit accounts with management access.
- Replace end-of-support Tenda AC10 devices where no vendor patch is available.
Patch Information
At the time of publication, no vendor advisory or firmware patch has been referenced for CVE-2024-11061. Consult the Tenda official website for firmware updates. If no fixed version is released for AC10 firmware 16.03.10.13, treat the device as unpatched and apply compensating controls or replace it with a supported model.
Workarounds
- Segment the router management interface onto an isolated administrative network unreachable from general user devices.
- Block external access to TCP ports serving the HTTP management interface at the network perimeter.
- Disable the wireless fast-setup workflow if configurable, and complete initial configuration only over trusted, wired connections.
- Consider replacing the affected device with a router that receives active security maintenance.
# Example: restrict router management access to a single admin host using an upstream firewall (iptables)
iptables -A FORWARD -p tcp -d 192.0.2.1 --dport 80 -s 192.0.2.10 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.0.2.1 --dport 80 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
