CVE-2024-11248: Tenda AC10 Buffer Overflow Vulnerability

CVE-2024-11248 Overview

CVE-2024-11248 is a stack-based buffer overflow in Tenda AC10 router firmware version 16.03.10.13. The flaw resides in the formSetRebootTimer function within /goform/SetSysAutoRebbotCfg. Attackers can manipulate the rebootTime argument to corrupt the stack and execute arbitrary code on the device. The vulnerability is exploitable remotely over the network and requires only low-privilege authentication. Public disclosure of the exploit technique has occurred through third-party research platforms. Successful exploitation compromises the confidentiality, integrity, and availability of the affected router, potentially giving adversaries a foothold in the network perimeter.

Critical Impact
Remote attackers with low privileges can trigger a stack-based buffer overflow in the Tenda AC10 web management interface, leading to arbitrary code execution on the router.

Affected Products

Tenda AC10 Firmware version 16.03.10.13
Tenda AC10 hardware revision 4.0
Web management endpoint /goform/SetSysAutoRebbotCfg

Discovery Timeline

2024-11-15 - CVE-2024-11248 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-11248

Vulnerability Analysis

The vulnerability is a classic stack-based buffer overflow classified under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer). The formSetRebootTimer handler processes HTTP POST parameters sent to /goform/SetSysAutoRebbotCfg. When the handler reads the rebootTime parameter, it copies the user-controlled value into a fixed-size stack buffer without verifying the input length. An attacker who submits an oversized rebootTime value overwrites adjacent stack memory, including saved registers and the return address.

Because Tenda AC10 firmware runs on a MIPS-based embedded Linux system with limited exploit mitigations, a crafted payload can redirect execution flow. Attackers can chain return-oriented programming (ROP) gadgets in the firmware to bypass non-executable stack protections and execute arbitrary shellcode. Refer to the Notion research writeup on Tenda AC10v4 for the technical proof-of-concept.

Root Cause

The root cause is missing bounds checking in the formSetRebootTimer function. The code uses an unsafe copy operation on the rebootTime query parameter without validating its size against the destination buffer. Embedded HTTP servers in consumer routers frequently rely on strcpy, sprintf, or memcpy without length constraints, and this handler follows that pattern.

Attack Vector

Exploitation requires network reachability to the router's web management interface and low-privilege authenticated access. An attacker sends a specially crafted HTTP request to /goform/SetSysAutoRebbotCfg containing an oversized rebootTime field. The overflow corrupts the saved return address on the stack, allowing the attacker to hijack control flow. Refer to the VulDB entry #284684 for additional exploit metadata.

Detection Methods for CVE-2024-11248

Indicators of Compromise

HTTP POST requests to /goform/SetSysAutoRebbotCfg containing abnormally long rebootTime parameter values
Unexpected reboots, service crashes, or httpd restarts on Tenda AC10 devices
Outbound connections from the router to unknown external hosts following administrative sessions
New firewall rules, DNS server changes, or configuration modifications not initiated by administrators

Detection Strategies

Inspect web server access logs on the router for POST requests to /goform/SetSysAutoRebbotCfg with parameter lengths exceeding typical values
Deploy network intrusion detection signatures that flag HTTP requests targeting the vulnerable goform endpoints with oversized payloads
Monitor for anomalous behavior between management stations and router administrative interfaces

Monitoring Recommendations

Baseline normal HTTP traffic patterns to the router management interface and alert on deviations in request size or frequency
Log all authentication events against the router web UI and correlate with subsequent configuration changes
Restrict router management access to a dedicated management VLAN and monitor traffic crossing that boundary

How to Mitigate CVE-2024-11248

Immediate Actions Required

Disable remote WAN-side management on all Tenda AC10 devices to eliminate internet-facing exposure
Restrict LAN-side access to the web management interface using access control lists that only permit trusted administrative hosts
Rotate router administrative credentials and enforce strong, unique passwords
Inventory all Tenda AC10 devices running firmware 16.03.10.13 and prioritize replacement or isolation

Patch Information

No vendor patch has been published in the referenced advisories at the time of writing. Consult the Tenda official website for firmware updates. If Tenda has not released a fixed firmware version, treat affected devices as end-of-support and plan replacement with a supported router.

Workarounds

Place affected routers behind an upstream firewall that blocks unsolicited inbound traffic to the management interface
Segment the router management plane onto an isolated network reachable only from authorized administrator workstations
Disable any port forwarding rules that expose the router's HTTP administrative service to the internet
Replace vulnerable Tenda AC10 devices with hardware from vendors providing active security maintenance

bash

# Example iptables rule to restrict router management access to a trusted admin subnet
iptables -A INPUT -p tcp --dport 80 -s 192.168.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -s 192.168.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP