CVE-2024-2816: Tenda AC15 Firmware CSRF Vulnerability

CVE-2024-2816 Overview

CVE-2024-2816 is a cross-site request forgery (CSRF) vulnerability in the Tenda AC15 router running firmware version 15.03.05.18. The flaw resides in the fromSysToolReboot function handling requests to /goform/SysToolReboot. An attacker can craft a malicious web page that, when visited by an authenticated administrator, forces the router to reboot without consent. The vulnerability is remotely exploitable across the network and requires user interaction. Public disclosure occurred through VulDB entry VDB-257671, and the vendor did not respond to disclosure attempts. The weakness is categorized as [CWE-352] Cross-Site Request Forgery.

Critical Impact
Remote attackers can force administrator-authenticated Tenda AC15 devices to reboot, causing network availability disruption for all connected clients.

Affected Products

Tenda AC15 hardware router
Tenda AC15 firmware version 15.03.05.18
Deployments using the /goform/SysToolReboot endpoint

Discovery Timeline

2024-03-22 - CVE-2024-2816 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-2816

Vulnerability Analysis

The vulnerability affects the fromSysToolReboot handler exposed through the /goform/SysToolReboot URI on the Tenda AC15 web management interface. The handler processes reboot requests without validating that the request originated from the router's own administrative interface. No anti-CSRF token, Origin header check, or Referer header validation is performed before executing the reboot action.

An attacker hosts a malicious page containing an auto-submitting form or image tag targeting the vulnerable endpoint. When an administrator with an active router session visits the page, the browser automatically attaches session credentials to the forged request. The router accepts the request as legitimate and initiates a system reboot.

The outcome is a denial-of-service condition affecting every client relying on the router for connectivity. Repeated exploitation can be used to hold the network in a persistent reboot loop. According to EPSS data from 2026-09-08, the probability of exploitation is low, but the trivial exploitation mechanism makes opportunistic abuse feasible.

Root Cause

The root cause is the absence of CSRF protections on state-changing HTTP requests in the AC15 web management interface. The fromSysToolReboot function trusts any authenticated session cookie without verifying request provenance, violating the defense recommended in [CWE-352].

Attack Vector

Exploitation requires the target administrator to visit an attacker-controlled page while holding an active session on the router. The attacker does not need credentials, network position on the LAN, or prior privileges. Delivery vectors include phishing emails, malicious advertisements, and compromised websites. Technical details are documented in the GitHub IoT Vulnerability Documentation and VulDB #257671.

// No verified exploit code is published with this advisory.
// The vulnerability is triggered by a forged HTTP request to
// /goform/SysToolReboot submitted from an attacker-controlled page
// while the victim holds an authenticated router session.

Detection Methods for CVE-2024-2816

Indicators of Compromise

Unexpected reboot events logged by the Tenda AC15 device outside scheduled maintenance windows
Inbound HTTP POST requests to /goform/SysToolReboot with a Referer header pointing to an external domain
Browser history entries on administrator workstations that precede router reboot events

Detection Strategies

Inspect router access logs for requests to /goform/SysToolReboot originating from unexpected referrers or user-agents
Correlate administrator browser activity with router availability drops to identify CSRF-driven reboots
Monitor network availability metrics for periodic short outages consistent with forced reboot activity

Monitoring Recommendations

Track uptime and reboot counters on all Tenda AC15 devices through SNMP or syslog forwarding
Alert on any HTTP request to /goform/ administrative endpoints when the source is outside the management VLAN
Enable browser-based warnings for administrators when accessing untrusted sites during router administration sessions

How to Mitigate CVE-2024-2816

Immediate Actions Required

Restrict access to the AC15 web management interface to a dedicated management VLAN or trusted IP range
Require administrators to log out of the router immediately after configuration changes to invalidate session cookies
Change the default administrative password and avoid reusing browser sessions for router administration and general browsing

Patch Information

No vendor patch is available. The advisory notes that Tenda was contacted about this disclosure but did not respond. Organizations should treat the AC15 firmware 15.03.05.18 as unsupported for this issue and plan hardware replacement or firmware migration where feasible. Reference the VulDB CTI Incident #257671 for tracking updates.

Workarounds

Disable remote web administration and limit management access to wired LAN interfaces only
Use a dedicated browser profile or isolated browser instance exclusively for router administration
Deploy a browser extension that blocks cross-origin POST requests to private network address ranges
Consider replacing the device with a router that receives active security updates and implements CSRF token protection

bash

# Example: restrict inbound access to the router management interface
# using an upstream firewall rule (adapt to your environment)
iptables -A FORWARD -p tcp -d 192.168.0.1 --dport 80 \
  -s 192.168.10.0/24 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.168.0.1 --dport 80 -j DROP