CVE-2024-2812 Overview
CVE-2024-2812 is an operating system command injection vulnerability [CWE-78] in the Tenda AC15 wireless router. The flaw resides in the formWriteFacMac function handling requests to the /goform/WriteFacMac endpoint. Attackers can manipulate the mac argument to inject arbitrary operating system commands. The exploit has been publicly disclosed and can be triggered remotely over the network. Tenda was contacted before public disclosure but did not respond. The vulnerability affects firmware versions 15.03.05.18 and 15.03.20_multi on the Tenda AC15 hardware platform.
Critical Impact
Authenticated remote attackers can execute arbitrary operating system commands on affected Tenda AC15 routers, leading to full device compromise.
Affected Products
- Tenda AC15 firmware version 15.03.05.18
- Tenda AC15 firmware version 15.03.20_multi
- Tenda AC15 hardware version 1.0
Discovery Timeline
- 2024-03-22 - CVE-2024-2812 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-2812
Vulnerability Analysis
The vulnerability is an OS command injection weakness classified under [CWE-78]. It exists in the formWriteFacMac function exposed through the /goform/WriteFacMac HTTP endpoint in the Tenda AC15 router web management interface. The router accepts a mac parameter that is passed to an underlying shell command without adequate sanitization or validation.
An attacker who sends a crafted HTTP request containing shell metacharacters in the mac parameter can break out of the intended argument context. The injected content is then interpreted by the system shell, allowing arbitrary command execution with the privileges of the web server process, typically root on embedded routers.
Successful exploitation yields full control over networking, firmware configuration, and any traffic transiting the device. Attackers can pivot to internal networks, capture credentials, or install persistent implants.
Root Cause
The root cause is missing input validation and unsafe use of shell command construction inside the formWriteFacMac handler. User-supplied MAC address data flows directly into a system command invocation without escaping or type checking, violating basic input separation between data and code.
Attack Vector
Exploitation requires network access to the router management interface and low-privilege authentication. The attacker sends an HTTP POST request to /goform/WriteFacMac with a mac parameter that contains shell metacharacters such as semicolons or backticks followed by the desired command payload. Public proof-of-concept material is available through the referenced GitHub IoT Vulnerability PoC and VulDB #257667 entry. No verified exploitation code is reproduced here.
Detection Methods for CVE-2024-2812
Indicators of Compromise
- HTTP POST requests to /goform/WriteFacMac where the mac parameter contains shell metacharacters such as ;, |, &, $(), or backticks.
- Unexpected outbound connections from the router to attacker-controlled infrastructure following management interface access.
- New processes or unfamiliar binaries running on the router shell environment.
- Modifications to router firmware configuration, DNS settings, or startup scripts that were not initiated by an administrator.
Detection Strategies
- Monitor router web management logs for anomalous parameter content targeting formWriteFacMac or other goform endpoints.
- Inspect network traffic for authenticated sessions issuing MAC-configuration requests outside of normal provisioning workflows.
- Correlate router administrative HTTP activity with subsequent unusual DNS lookups or outbound TCP sessions originating from the device.
Monitoring Recommendations
- Restrict router management access to a dedicated management VLAN and log all authentication attempts.
- Deploy network intrusion detection signatures for goform command injection patterns targeting Tenda devices.
- Baseline expected router configuration and alert on drift, especially changes to firmware factory settings.
How to Mitigate CVE-2024-2812
Immediate Actions Required
- Disable remote (WAN-side) administration on affected Tenda AC15 routers until a vendor patch is available.
- Restrict LAN-side administrative access to trusted management hosts only through firewall or ACL rules.
- Rotate all administrative credentials on affected routers and audit for unauthorized configuration changes.
- Consider replacing the device with a supported model if the vendor does not release a fixed firmware.
Patch Information
As of the last NVD update, Tenda has not published a security advisory or fixed firmware for CVE-2024-2812. The reporter noted that the vendor was contacted before disclosure and did not respond. Administrators should monitor the Tenda support portal for future firmware releases addressing the formWriteFacMac handler.
Workarounds
- Block external access to TCP ports used by the router web management interface at the network perimeter.
- Segment the router management plane from user and guest networks so that only authorized administrative endpoints can reach /goform/WriteFacMac.
- Apply strict egress filtering from the router itself to limit the impact of potential command execution.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
