CVE-2024-25746: Tenda AC9 Buffer Overflow Vulnerability

CVE-2024-25746 Overview

CVE-2024-25746 is a stack-based buffer overflow vulnerability in the Tenda AC9 v3.0 router running firmware version v.15.03.06.42_multi. The flaw resides in the add_white_node function and allows a remote attacker on an adjacent network to execute arbitrary code. The vulnerability is classified under [CWE-121] (Stack-based Buffer Overflow) and affects the router's web management interface.

Critical Impact
An attacker with adjacent network access can execute arbitrary code on the router, potentially gaining full control of the device and pivoting into the connected network.

Affected Products

Tenda AC9 v3.0 (hardware)
Tenda AC9 firmware version v.15.03.06.42_multi
Devices running the vulnerable add_white_node function

Discovery Timeline

2024-02-22 - CVE-2024-25746 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-25746

Vulnerability Analysis

The vulnerability exists in the add_white_node function of the Tenda AC9 v3.0 router firmware. This function processes input related to MAC address white-listing on the device's web administration interface. The function fails to validate the length of user-supplied input before copying it into a fixed-size stack buffer. An attacker who reaches the router over an adjacent network can send a crafted request that overflows the buffer, corrupts the stack, and redirects execution to attacker-controlled code.

Successful exploitation yields arbitrary code execution in the context of the router's management process. Compromise of the router grants attackers a foothold to intercept LAN traffic, modify DNS settings, or launch further attacks against connected clients.

Root Cause

The root cause is missing bounds checking on parameters processed by the add_white_node function. The function accepts attacker-controlled data from HTTP request parameters and copies it into a stack-allocated buffer without verifying the destination size. This is a classic [CWE-121] stack-based buffer overflow pattern common in embedded router firmware.

Attack Vector

Exploitation requires adjacent network access, meaning the attacker must reside on the same logical network segment as the device, such as connecting to the router's Wi-Fi or a directly attached LAN. No authentication or user interaction is required. The attacker sends a specially crafted request targeting the vulnerable add_white_node endpoint to trigger the overflow.

Technical details and a proof of concept are documented in the GitHub PoC Repository.

Detection Methods for CVE-2024-25746

Indicators of Compromise

Unexpected HTTP POST requests targeting the router's web management interface with oversized parameters related to MAC address white-listing
Unexplained router reboots, crashes, or degraded performance following management-interface requests
Unauthorized changes to router configuration, DNS settings, or firewall rules
New or unknown MAC addresses appearing in the router's access control lists

Detection Strategies

Inspect network traffic to the router's management interface for abnormally long parameter values sent to add_white_node handlers
Monitor for management-interface access originating from unexpected LAN clients or wireless guests
Alert on repeated malformed HTTP requests to router administration endpoints

Monitoring Recommendations

Enable logging on the router where supported and forward logs to a centralized collector for review
Baseline normal router administrative traffic to identify anomalous request patterns
Segment router management interfaces onto a dedicated VLAN and monitor cross-segment traffic

How to Mitigate CVE-2024-25746

Immediate Actions Required

Restrict access to the router's web management interface to trusted management hosts only
Disable remote administration and Wi-Fi access to the management interface where feasible
Isolate vulnerable Tenda AC9 devices on a dedicated network segment away from sensitive systems
Replace end-of-life or unpatched Tenda AC9 devices with supported hardware

Patch Information

No vendor advisory or official patch is listed in the CVE data for this vulnerability. Organizations should monitor Tenda's support channels for firmware updates addressing the add_white_node function and apply any released firmware as soon as it becomes available.

Workarounds

Change default administrator credentials and use strong, unique passwords for router access
Disable the MAC address white-listing feature if it is not required in your environment
Restrict wireless network access using WPA2/WPA3 with strong pre-shared keys to limit adjacent-network exposure
Consider replacing the device with a router that receives active security updates

bash

# Example: restrict access to router management interface via upstream firewall
# Allow only a designated admin host to reach the router web UI
iptables -A FORWARD -s 192.0.2.10 -d <router_ip> -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -d <router_ip> -p tcp --dport 80 -j DROP