CVE-2024-28551: Tenda AC18 Buffer Overflow Vulnerability

CVE-2024-28551 Overview

CVE-2024-28551 is a stack-based buffer overflow vulnerability [CWE-121] in the Tenda AC18 router running firmware version 15.03.05.05. The flaw resides in the form_fast_setting_wifi_set function, where the ssid parameter is processed without proper bounds checking. An unauthenticated remote attacker can send a crafted HTTP request to trigger the overflow on the device's stack. Successful exploitation results in a denial-of-service condition on the affected router. The vulnerability is reachable over the network with no authentication or user interaction required.

Critical Impact

Unauthenticated remote attackers can crash the Tenda AC18 router by sending an oversized ssid value to the WiFi fast-setting endpoint, disrupting network connectivity.

Affected Products

• Tenda AC18 router (hardware)
• Tenda AC18 firmware version 15.03.05.05
• Web management interface exposing form_fast_setting_wifi_set

Discovery Timeline

• 2024-03-26 - CVE-2024-28551 published to the National Vulnerability Database (NVD)
• 2025-03-13 - Last updated in the NVD database

Technical Details for CVE-2024-28551

Vulnerability Analysis

The Tenda AC18 web management interface exposes the form_fast_setting_wifi_set handler, which configures wireless settings during initial device setup. The handler reads the ssid parameter from an attacker-controlled HTTP request and copies it into a fixed-size stack buffer. Because the function performs no length validation on the input, an oversized ssid value overflows the buffer and overwrites adjacent stack memory, including the saved return address.

The corrupted stack frame causes the httpd process to crash when execution returns from the vulnerable function. The router becomes unresponsive until it reboots or is manually restarted. The vulnerability is classified under [CWE-121] Stack-based Buffer Overflow.

Root Cause

The root cause is missing input validation on the ssid HTTP parameter inside form_fast_setting_wifi_set. The handler uses an unbounded copy operation into a stack-allocated buffer sized for a normal SSID string. Attacker-supplied data longer than the buffer corrupts saved registers and the return address on the stack.

Attack Vector

The attack vector is network-based and requires no authentication. An attacker sends an HTTP POST request to the router's management interface with a long ssid value. The request reaches the vulnerable function during request handling, triggering the overflow. The publicly available proof-of-concept demonstrates a denial-of-service outcome against the httpd daemon. Refer to the GitHub IoT Vulnerability PoC for technical reproduction steps.

Detection Methods for CVE-2024-28551

Indicators of Compromise

• Unexpected reboots or httpd process crashes on Tenda AC18 routers
• HTTP POST requests to setup endpoints containing abnormally long ssid parameter values
• Loss of management interface availability following inbound HTTP traffic from untrusted sources

Detection Strategies

• Inspect HTTP traffic to the router management interface for ssid parameter values exceeding typical SSID length limits (32 bytes per IEEE 802.11)
• Monitor router system logs for repeated httpd restarts or watchdog-triggered reboots
• Deploy network intrusion detection signatures targeting requests to form_fast_setting_wifi_set with oversized POST bodies

Monitoring Recommendations

• Alert on any external source attempting to reach the router's web administration port
• Track availability metrics for the router and correlate downtime with inbound HTTP request bursts
• Capture and review packet samples destined for the management interface for anomalous parameter lengths

How to Mitigate CVE-2024-28551

Immediate Actions Required

• Restrict access to the Tenda AC18 web management interface to trusted internal hosts only
• Disable remote management (WAN-side administration) if it is currently enabled
• Segment the router management network from untrusted user and IoT segments

Patch Information

No vendor advisory or firmware update from Tenda is referenced in the NVD entry for CVE-2024-28551 at the time of publication. Administrators should monitor the Tenda support site for firmware releases addressing version 15.03.05.05 and apply updates as they become available.

Workarounds

• Block inbound HTTP and HTTPS traffic to the router management interface from untrusted networks using upstream firewall rules
• Replace the affected Tenda AC18 device with a supported router if no patch is released by the vendor
• Place the device behind a network filter that drops requests containing ssid parameter values longer than 32 bytes

# Example upstream firewall rule restricting router admin access to a management subnet
iptables -A FORWARD -p tcp -d 192.168.0.1 --dport 80 -s 10.0.10.0/24 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.168.0.1 --dport 80 -j DROP