CVE-2024-2850: Tenda AC15 Buffer Overflow Vulnerability

CVE-2024-2850 Overview

CVE-2024-2850 is a stack-based buffer overflow [CWE-121] in the Tenda AC15 router running firmware version 15.03.05.18. The flaw resides in the saveParentControlInfo function handling requests to /goform/saveParentControlInfo. Manipulation of the urls parameter overflows a fixed-size stack buffer, corrupting saved return addresses and adjacent stack data. The vulnerability is remotely exploitable over the network without authentication or user interaction. The exploit details have been publicly disclosed, increasing the risk of opportunistic attacks against exposed devices. The vendor was contacted before disclosure but did not respond.

Critical Impact

Unauthenticated attackers can trigger memory corruption on the device, enabling remote code execution, full device compromise, and pivoting into the protected network segment.

Affected Products

• Tenda AC15 hardware router
• Tenda AC15 firmware version 15.03.05.18
• Web management interface endpoint /goform/saveParentControlInfo

Discovery Timeline

• 2024-03-24 - CVE-2024-2850 published to the National Vulnerability Database (NVD)
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-2850

Vulnerability Analysis

The Tenda AC15 web management binary exposes the saveParentControlInfo handler through the /goform/ interface. This handler processes the urls HTTP parameter, which is intended to store URL filter entries for the parental control feature. The handler copies the attacker-controlled urls value into a fixed-size stack buffer without validating the input length, producing a classic stack-based buffer overflow.

The overflow overwrites adjacent stack memory, including saved registers and the return address. On MIPS-based Tenda firmware, this allows redirection of execution flow once the corrupted function epilogue executes. Because the web service runs with elevated privileges on the embedded Linux system, successful exploitation yields complete control of the router, including DNS settings, traffic interception, firmware persistence, and lateral access to clients on the LAN.

Root Cause

The root cause is the absence of bounds checking on the urls request parameter before invoking an unsafe copy operation into a stack-allocated buffer. The firmware does not enforce length validation or use safer string-handling primitives, and the binary appears to lack stack canaries that would detect corruption before return.

Attack Vector

An unauthenticated remote attacker sends a crafted HTTP POST request to /goform/saveParentControlInfo with an oversized urls value. Devices with the web interface reachable from the WAN, or attackers already on the LAN, can reach the endpoint directly. Public technical documentation of the issue is available in the GitHub Vulnerability Documentation and the VulDB advisory #257774.

No verified exploit code is reproduced here. Refer to the linked technical references for parameter layout and offset details.

Detection Methods for CVE-2024-2850

Indicators of Compromise

• HTTP POST requests to /goform/saveParentControlInfo containing abnormally long urls parameter values, particularly those exceeding several hundred bytes.
• Unexpected reboots, watchdog resets, or httpd crashes on Tenda AC15 devices following inbound HTTP traffic.
• Outbound connections from the router itself to unknown hosts, indicating possible post-exploitation implants.
• Modifications to router DNS configuration or unexpected firmware checksum changes.

Detection Strategies

• Inspect web server and reverse-proxy logs for requests targeting /goform/saveParentControlInfo with payload sizes inconsistent with legitimate parental control entries.
• Deploy network IDS signatures that match oversized urls POST bodies directed at Tenda management endpoints.
• Correlate router crash telemetry with preceding HTTP requests to identify exploitation attempts.

Monitoring Recommendations

• Monitor north-south traffic to router management interfaces and alert on management endpoints exposed to the WAN.
• Track DNS configuration drift on consumer-grade routers used in branch or remote-work environments.
• Forward router syslog data to a centralized SIEM and alert on repeated httpd restarts.

How to Mitigate CVE-2024-2850

Immediate Actions Required

• Disable remote (WAN-side) administration on all Tenda AC15 devices and restrict the web interface to trusted LAN segments only.
• Segment AC15 routers away from sensitive internal assets until a fixed firmware is available.
• Replace AC15 devices used in production environments with a supported router, given the absence of a vendor response.

Patch Information

No vendor patch is currently available. The vendor was contacted prior to disclosure and did not respond, per the NVD entry. Track the VulDB entry #257774 for updates and check the Tenda support portal for any future firmware release superseding 15.03.05.18.

Workarounds

• Block external access to TCP ports 80 and 443 on the router WAN interface using upstream filtering where possible.
• Restrict access to /goform/saveParentControlInfo via an intermediate firewall or by disabling the parental control feature in the web UI.
• Place the router behind a network device capable of inspecting and dropping oversized HTTP parameter values targeting management endpoints.

# Example upstream firewall rules to block WAN access to the router management interface
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -j DROP
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -j DROP