CVE-2024-2817: Tenda AC15 Firmware CSRF Vulnerability

CVE-2024-2817 Overview

CVE-2024-2817 is a cross-site request forgery (CSRF) vulnerability [CWE-352] in the Tenda AC15 router running firmware version 15.03.05.18. The flaw resides in the fromSysToolRestoreSet function handled by the /goform/SysToolRestoreSet endpoint. An attacker can trick an authenticated administrator into visiting a crafted web page that silently issues a factory-reset request to the router, disrupting network availability. The exploit has been publicly disclosed. According to the advisory, the vendor was contacted prior to disclosure but did not respond.

Critical Impact
A successful CSRF attack forces the router to restore factory defaults, wiping configuration and causing an availability outage across the connected network.

Affected Products

Tenda AC15 (hardware)
Tenda AC15 Firmware version 15.03.05.18
Endpoint: /goform/SysToolRestoreSet (function fromSysToolRestoreSet)

Discovery Timeline

2024-03-22 - CVE-2024-2817 published to NVD (VulDB identifier VDB-257672)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-2817

Vulnerability Analysis

The Tenda AC15 web management interface exposes administrative actions through /goform/* handlers. The fromSysToolRestoreSet handler executes a factory-reset routine when it receives a request from an authenticated session. The handler does not validate the origin or include an anti-CSRF token with the request. As a result, any authenticated administrator who loads attacker-controlled content in the same browser session can be coerced into triggering the reset. The vulnerability does not expose data confidentiality or integrity directly, but it eliminates device configuration and causes a service outage.

Root Cause

The root cause is missing CSRF protection on a state-changing administrative endpoint [CWE-352]. The fromSysToolRestoreSet function relies solely on session authentication to authorize the reset. It does not check the HTTP Origin or Referer header, nor does it require a per-session unpredictable token. Browsers automatically attach session cookies to cross-origin requests, which allows an off-domain page to invoke the handler on behalf of the logged-in administrator.

Attack Vector

Exploitation requires an administrator to be logged into the Tenda AC15 web interface and to visit an attacker-controlled page in the same browser. The malicious page submits a forged HTTP request to /goform/SysToolRestoreSet on the router's LAN address. The router processes the request as legitimate and performs a factory reset. The attack succeeds without any credentials being exposed to the attacker. See the GitHub vulnerability documentation and the VulDB entry #257672 for the published proof-of-concept description.

Detection Methods for CVE-2024-2817

Indicators of Compromise

Unexpected HTTP POST or GET requests to /goform/SysToolRestoreSet originating from an administrator workstation.
Router configuration unexpectedly reverting to factory defaults, including loss of Wi-Fi SSID, admin password, and port forwarding rules.
HTTP referrer headers in router logs pointing to third-party or unknown domains preceding a reset event.

Detection Strategies

Inspect network traffic for requests to /goform/SysToolRestoreSet where the Referer or Origin header does not match the router's management hostname or IP.
Correlate browser history on administrator workstations with router reset events logged in SNMP, syslog, or network monitoring telemetry.
Alert on sudden drops in uptime counters or configuration-version changes reported by the Tenda AC15 to the management network.

Monitoring Recommendations

Forward router syslog to a centralized log store and build alerts on restore, reset, or configuration-change messages.
Monitor DHCP and ARP tables for mass client re-registration events that typically follow a factory reset.
Review web-proxy logs for administrator sessions visiting untrusted sites while authenticated to router management interfaces.

How to Mitigate CVE-2024-2817

Immediate Actions Required

Restrict access to the Tenda AC15 web management interface to a dedicated management VLAN or specific administrative hosts.
Log out of the router web interface immediately after administrative tasks and clear browser cookies for the management IP.
Avoid browsing untrusted websites in the same browser session used for router administration.
Change the default administrative credentials and disable remote WAN-side management.

Patch Information

No vendor patch has been published for CVE-2024-2817 at the time of writing. The advisory records that the vendor was contacted but did not respond. Monitor the VulDB entry #257672 and Tenda's support site for firmware updates beyond 15.03.05.18.

Workarounds

Use a dedicated browser profile or isolated browser for router administration to break cross-site cookie reuse.
Place the AC15 management interface behind an upstream firewall rule that only permits connections from trusted internal IPs.
Replace the device with a model from a vendor that enforces anti-CSRF tokens on administrative endpoints if a patch is not forthcoming.

bash

# Example: restrict router management access to a single admin host using an upstream firewall (Linux iptables)
iptables -A FORWARD -s 192.168.1.10 -d 192.168.0.1 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -d 192.168.0.1 -p tcp --dport 80 -j DROP