CVE-2024-28383: Tenda AX12 Buffer Overflow Vulnerability

CVE-2024-28383 Overview

CVE-2024-28383 is a stack-based buffer overflow [CWE-121] in the Tenda AX12 wireless router running firmware version v22.03.01.16. The flaw resides in the sub_431CF0 function, which fails to validate the length of the ssid parameter before copying it onto the stack. Attackers reachable over the network can supply an oversized ssid value to corrupt stack memory, crash the device, or potentially execute arbitrary code in the context of the router process. The vulnerability requires no authentication and no user interaction, making exposed management interfaces a direct attack surface.

Critical Impact

Unauthenticated network attackers can trigger memory corruption in the Tenda AX12 router and gain code execution or cause denial of service against affected devices.

Affected Products

• Tenda AX12 firmware version 22.03.01.16_cn
• Tenda AX12 hardware (all hardware revisions running the affected firmware)
• CPE: cpe:2.3:o:tenda:ax12_firmware:22.03.01.16_cn:*:*:*:*:*:*:*

Discovery Timeline

• 2024-03-14 - CVE-2024-28383 published to the National Vulnerability Database (NVD)
• 2025-03-13 - Last updated in NVD database

Technical Details for CVE-2024-28383

Vulnerability Analysis

The defect is a classic stack overflow inside sub_431CF0, a routine that processes the ssid parameter supplied through the router's HTTP management interface. The function copies attacker-controlled input into a fixed-size stack buffer without enforcing a length check. When the supplied ssid exceeds the buffer size, adjacent stack data including the saved return address is overwritten.

Because the AX12 firmware runs on a MIPS or ARM embedded Linux platform without modern exploit mitigations such as stack canaries or full ASLR, control flow hijacking becomes practical. An attacker who can reach the router's web administration service can submit a crafted ssid value and divert execution to attacker-controlled shellcode or return-oriented programming gadgets.

Root Cause

The root cause is missing input validation on the ssid HTTP parameter before it is passed to a stack-allocated buffer inside sub_431CF0. The handler trusts the client-supplied length and uses an unbounded copy operation, which violates safe string handling practices on embedded systems.

Attack Vector

Exploitation occurs over the network against the router's management interface. An attacker sends an HTTP request containing an overlong ssid parameter to the vulnerable endpoint serviced by sub_431CF0. Successful exploitation overwrites the saved return address and yields code execution as the web server process, typically root on consumer routers. Devices that expose the management interface to the WAN are remotely exploitable. Technical reproduction notes are available in the public GitHub PoC repository.

Detection Methods for CVE-2024-28383

Indicators of Compromise

• HTTP requests to the router management interface containing abnormally long ssid parameter values, particularly exceeding 128 bytes
• Unexpected reboots, crashes, or watchdog resets of the Tenda AX12 router
• New outbound connections from the router to unknown infrastructure following a malformed configuration request

Detection Strategies

• Inspect HTTP traffic destined for router administration endpoints and alert on ssid parameter values exceeding expected length (32 bytes per IEEE 802.11)
• Monitor for repeated POST requests to wireless configuration endpoints originating from a single source within a short time window
• Correlate router availability monitoring with security event logs to identify exploitation-induced crashes

Monitoring Recommendations

• Forward router syslog and management plane events to a centralized logging platform for retention and analysis
• Baseline normal administrative traffic patterns to the router and alert on deviations
• Track firmware version inventory across all Tenda AX12 deployments to identify unpatched devices

How to Mitigate CVE-2024-28383

Immediate Actions Required

• Restrict access to the router management interface to trusted internal networks only and disable remote WAN administration
• Place affected Tenda AX12 devices behind a network firewall that blocks inbound HTTP and HTTPS to the device
• Inventory all Tenda AX12 routers running firmware 22.03.01.16 and prioritize them for replacement or isolation
• Rotate Wi-Fi and administrator credentials on any device suspected of being exposed to untrusted networks

Patch Information

No vendor patch has been published in the NVD record at the time of writing. Administrators should monitor the Tenda support portal for firmware updates addressing sub_431CF0 and apply them as soon as they become available. If no fix is released, consider replacing the device with a supported model.

Workarounds

• Disable the router's web management interface on the WAN side and limit LAN-side access by IP allowlist where supported
• Segment the router onto a dedicated management VLAN to reduce the population of hosts able to reach the vulnerable endpoint
• Deploy an upstream intrusion prevention rule that drops HTTP requests containing ssid parameter values longer than 32 bytes

# Example iptables rule to restrict router management access to a trusted host
iptables -A INPUT -p tcp --dport 80 -s 192.0.2.10 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -s 192.0.2.10 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP