CVE-2024-2855 Overview
CVE-2024-2855 is a stack-based buffer overflow [CWE-121] in the Tenda AC15 router affecting firmware versions 15.03.05.18, 15.03.05.19, and 15.03.20. The flaw resides in the fromSetSysTime function handling requests to /goform/SetSysTimeCfg. An attacker can manipulate the time argument to overflow a fixed-size stack buffer. The attack is remotely exploitable without authentication or user interaction. The exploit details have been disclosed publicly under VulDB identifier VDB-257779. The vendor was contacted before disclosure but did not respond.
Critical Impact
Unauthenticated remote attackers can trigger a stack-based buffer overflow against the router's HTTP service, potentially leading to arbitrary code execution or denial of service on affected Tenda AC15 devices.
Affected Products
- Tenda AC15 firmware 15.03.05.18
- Tenda AC15 firmware 15.03.05.19
- Tenda AC15 firmware 15.03.20 (multi)
Discovery Timeline
- 2024-03-24 - CVE-2024-2855 published to NVD
- 2024-11-21 - Last updated in NVD database
Technical Details for CVE-2024-2855
Vulnerability Analysis
The vulnerability exists in the fromSetSysTime function used to process system time configuration requests on the Tenda AC15 web management interface. The endpoint /goform/SetSysTimeCfg accepts a time parameter that is copied into a fixed-size stack buffer without proper bounds checking. Supplying an oversized value overruns adjacent stack memory, including the saved return address. Because the AC15 firmware lacks robust exploit mitigations typical of consumer routers, an attacker controlling stack contents can redirect execution flow. The result is denial of service through process crash or, with a tailored payload, arbitrary code execution within the context of the web service.
Root Cause
The root cause is unsafe handling of user-controlled input in fromSetSysTime. The function uses an unchecked string copy operation to move the time argument into a local stack buffer. No length validation is performed before the copy, allowing data beyond the buffer's allocated size to overwrite the saved frame pointer and return address [CWE-121].
Attack Vector
The attack is launched over the network against the router's HTTP management service. An attacker sends a crafted POST request to /goform/SetSysTimeCfg containing an overly long time parameter. No credentials or user interaction are required. The vulnerability manifests when the request reaches the fromSetSysTime handler, which immediately copies the attacker-supplied value onto the stack. See the GitHub Vulnerability Report for the technical proof-of-concept details.
Detection Methods for CVE-2024-2855
Indicators of Compromise
- HTTP POST requests to /goform/SetSysTimeCfg containing abnormally long time parameter values.
- Repeated crashes or unexpected reboots of the Tenda AC15 web management daemon (httpd).
- Unsolicited inbound HTTP traffic to the router's management interface from external sources.
Detection Strategies
- Inspect web server and router syslog output for malformed requests targeting /goform/SetSysTimeCfg.
- Deploy network intrusion detection signatures that flag HTTP requests with time parameter lengths exceeding expected ISO 8601 datetime formats.
- Correlate router availability anomalies with inbound HTTP traffic to identify exploitation attempts.
Monitoring Recommendations
- Monitor the WAN-side exposure of the router's HTTP management interface and alert on any external access attempts.
- Log all administrative HTTP POSTs to /goform/* endpoints and review for oversized payloads.
- Track firmware version inventory across deployed Tenda AC15 devices to identify vulnerable units.
How to Mitigate CVE-2024-2855
Immediate Actions Required
- Disable remote (WAN-side) administration on Tenda AC15 routers until a patched firmware is available.
- Restrict access to the LAN management interface using firewall rules or VLAN segmentation.
- Replace end-of-support Tenda AC15 devices with actively maintained hardware where feasible.
Patch Information
No vendor patch is available. The VulDB report notes that the vendor was contacted before public disclosure but did not respond. Affected organizations should treat the AC15 firmware versions 15.03.05.18, 15.03.05.19, and 15.03.20 as unsupported and assume the vulnerability will remain unfixed. Refer to VulDB #257779 for the latest status.
Workarounds
- Block external access to TCP port 80 and TCP port 443 on the router's WAN interface.
- Place the device behind a network firewall that filters unsolicited inbound HTTP traffic.
- Limit management access to a dedicated administrative subnet, and require VPN access for remote configuration changes.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
