CVE-2024-28545: Tenda AC18 Firmware RCE Vulnerability

CVE-2024-28545 Overview

CVE-2024-28545 is a command injection vulnerability affecting the Tenda AC18 wireless router running firmware version V15.03.05.05. The vulnerability exists in the deviceName parameter of the formsetUsbUnload function, allowing remote attackers to execute arbitrary commands on the affected device without authentication.

Critical Impact

This command injection vulnerability enables unauthenticated remote attackers to gain complete control over affected Tenda AC18 routers, potentially compromising network security and enabling further attacks on connected devices.

Affected Products

• Tenda AC18 Firmware V15.03.05.05
• Tenda AC18 Hardware Device

Discovery Timeline

• 2024-03-26 - CVE-2024-28545 published to NVD
• 2025-03-13 - Last updated in NVD database

Technical Details for CVE-2024-28545

Vulnerability Analysis

This command injection vulnerability (CWE-77) resides in the formsetUsbUnload function of the Tenda AC18 router firmware. The function fails to properly sanitize user-supplied input in the deviceName parameter before passing it to system shell commands. This allows an attacker to inject arbitrary operating system commands that execute with the privileges of the web server process, typically root on embedded IoT devices.

The vulnerability is exploitable over the network without requiring authentication or user interaction, making it particularly dangerous for internet-exposed devices. Successful exploitation grants attackers complete control over the router, enabling them to intercept network traffic, modify DNS settings, pivot to internal network resources, or conscript the device into a botnet.

Root Cause

The root cause of this vulnerability is improper input validation in the formsetUsbUnload function. The deviceName parameter is passed directly to a system command without proper sanitization or escaping of shell metacharacters. This allows attackers to break out of the intended command context and execute arbitrary shell commands by including command separators or other shell metacharacters in the input.

Attack Vector

The attack vector for CVE-2024-28545 is network-based. An attacker can craft a malicious HTTP request to the router's web management interface containing shell metacharacters in the deviceName parameter. When the formsetUsbUnload function processes this request, the injected commands are executed on the underlying operating system.

Typical exploitation involves sending specially crafted requests containing command injection payloads such as command separators (;, |, ||, &&) or command substitution characters ($(), backticks) within the deviceName parameter. For detailed technical information about this vulnerability, refer to the GitHub Vulnerability Documentation.

Detection Methods for CVE-2024-28545

Indicators of Compromise

• Unexpected outbound connections from the router to unknown IP addresses
• Unusual processes running on the router that are not part of standard firmware
• Modified DNS settings or firewall rules without administrator action
• Presence of unfamiliar files or scripts in the router's file system

Detection Strategies

• Monitor HTTP requests to the router's web interface for shell metacharacters in the deviceName parameter
• Implement network intrusion detection rules to identify command injection patterns in requests to Tenda devices
• Review router logs for unusual USB unload operations or unexpected command executions
• Deploy honeypot routers to detect scanning and exploitation attempts targeting this vulnerability

Monitoring Recommendations

• Enable verbose logging on the router if available and monitor for suspicious activity
• Implement network segmentation to isolate IoT devices from critical network resources
• Use network monitoring tools to detect anomalous traffic patterns from router IP addresses
• Regularly audit router configurations for unauthorized changes

How to Mitigate CVE-2024-28545

Immediate Actions Required

• Restrict access to the router's web management interface to trusted internal networks only
• Disable remote management features if enabled
• Place the router behind a firewall that blocks external access to management ports
• Consider replacing the affected device with a supported model if no patch is available

Patch Information

At the time of writing, no official patch information from Tenda has been identified in available security advisories. Users should check the Tenda official website for firmware updates addressing this vulnerability. Given the critical nature of this command injection vulnerability, immediate implementation of workarounds is strongly recommended until an official patch becomes available.

Workarounds

• Disable the USB storage functionality on the router if not required
• Implement network access control lists (ACLs) to restrict access to the router's web interface
• Deploy a web application firewall (WAF) in front of the router to filter malicious requests
• Consider network isolation strategies to minimize the impact of potential compromise

# Example: Restrict management interface access (if router supports ACL configuration)
# Access router CLI and configure access restrictions
# Note: Exact commands vary by firmware version

# Disable remote management
config set remote_management=disabled

# Restrict web interface to specific IP range
config set mgmt_access_ip=192.168.1.0/24
config set mgmt_access_enabled=true

# Apply configuration
config commit