CVE-2024-2707: Tenda AC10U Firmware RCE Vulnerability

CVE-2024-2707 Overview

CVE-2024-2707 is an operating system command injection vulnerability in the Tenda AC10U wireless router running firmware version 15.03.06.49. The flaw resides in the formWriteFacMac function handling requests to the /goform/WriteFacMac endpoint. Attackers can manipulate the mac parameter to inject arbitrary shell commands that execute on the underlying Linux system. The vulnerability is exploitable over the network and requires only low-privileged access. Public exploit details have been disclosed, and the vendor did not respond to disclosure attempts.

Critical Impact
Remote authenticated attackers can execute arbitrary operating system commands on affected Tenda AC10U routers, leading to full device compromise and potential pivoting into internal networks.

Affected Products

Tenda AC10U hardware routers
Tenda AC10U firmware version 15.03.06.49
Deployments exposing the /goform/WriteFacMac endpoint to reachable networks

Discovery Timeline

2024-03-20 - CVE-2024-2707 published to NVD with VulDB identifier VDB-257458
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-2707

Vulnerability Analysis

The vulnerability is classified as an OS command injection weakness [CWE-78]. The formWriteFacMac handler in the Tenda AC10U web management interface processes requests sent to /goform/WriteFacMac. This handler is intended to write a factory MAC address into device configuration. The handler passes the attacker-controlled mac argument into a shell command without proper sanitization or argument escaping.

Because the input is concatenated directly into a system command string, an attacker can supply shell metacharacters such as ;, |, or backticks to break out of the intended command context. Injected commands run in the context of the router's web server process, which on most Tenda consumer devices operates with root privileges. Successful exploitation grants full command execution on the device.

Root Cause

The root cause is the absence of input validation and unsafe use of shell command execution APIs inside the formWriteFacMac function. Firmware developers passed the mac parameter to a system()-style call without validating that the value conforms to a MAC address format or escaping shell metacharacters before invocation.

Attack Vector

The attack is initiated over the network against the router's HTTP management interface. An attacker with credentials to the administrative interface, or access to a session on the LAN, sends a crafted POST request to /goform/WriteFacMac containing a malicious mac parameter. The injected commands execute immediately. Exploitation does not require user interaction, and public documentation of the exploitation technique is available in the GitHub IoT Vulnerability Documentation.

No verified proof-of-concept code is reproduced here. Refer to the VulDB #257458 entry for additional technical details.

Detection Methods for CVE-2024-2707

Indicators of Compromise

HTTP POST requests to /goform/WriteFacMac containing shell metacharacters such as ;, |, &, or backticks in the mac parameter
Unexpected outbound connections originating from the router to attacker-controlled infrastructure
New or modified files in writable firmware locations such as /tmp or /var on the device
Router configuration changes or account additions that were not initiated by administrators

Detection Strategies

Inspect web server access logs from the router or upstream proxies for requests targeting /goform/WriteFacMac with non-hexadecimal characters in the mac value
Deploy network intrusion detection signatures that match on HTTP request bodies containing WriteFacMac combined with shell metacharacters
Monitor DNS and NetFlow telemetry for anomalous egress traffic from router management IPs, which typically should not initiate outbound sessions

Monitoring Recommendations

Forward router syslog and web-management access logs to a centralized SIEM for correlation and alerting on suspicious /goform/ endpoint activity
Alert on any administrative HTTP requests to Tenda routers from unexpected source addresses, especially outside management VLANs
Track firmware version inventory to identify AC10U devices running the vulnerable 15.03.06.49 build

How to Mitigate CVE-2024-2707

Immediate Actions Required

Restrict access to the Tenda AC10U web management interface to a dedicated management VLAN and block it from untrusted networks and the internet
Rotate all administrative credentials on affected devices to prevent reuse of low-privilege accounts required for exploitation
Audit affected devices for signs of prior compromise, including unauthorized configuration changes and unexplained processes
Consider replacing affected devices with supported hardware if no vendor patch becomes available

Patch Information

No vendor patch is available at the time of publication. Tenda was contacted about the disclosure but did not respond, and no fixed firmware version has been released for the AC10U 15.03.06.49 build. Organizations operating affected devices should treat them as end-of-support from a security standpoint until Tenda publishes a corrected firmware image.

Workarounds

Disable remote (WAN-side) management on the router and permit administrative HTTP access only from a restricted set of trusted internal IP addresses
Place the router behind a reverse proxy or web application firewall that blocks requests to /goform/WriteFacMac or filters shell metacharacters in POST bodies
Segment IoT and consumer-grade networking equipment onto isolated network segments to limit lateral movement if a device is compromised
Remove unused administrative accounts and enforce strong, unique passwords for all remaining accounts to reduce the pool of credentials usable for exploitation

bash

# Example firewall rule restricting router management to a trusted subnet
iptables -A INPUT -p tcp --dport 80 -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP