CVE-2024-2897: Tenda AC7 Firmware RCE Vulnerability

CVE-2024-2897 Overview

CVE-2024-2897 is an operating system command injection vulnerability in the Tenda AC7 router running firmware version 15.03.06.44. The flaw resides in the formWriteFacMac function handling requests to /goform/WriteFacMac. An attacker can manipulate the mac argument to inject arbitrary shell commands executed by the router's underlying operating system. The issue is remotely exploitable across the network and the exploit has been publicly disclosed. The vulnerability is tracked as VulDB entry VDB-257940 and maps to CWE-78.

Critical Impact
Authenticated network attackers can execute arbitrary OS commands on affected Tenda AC7 devices, gaining full control over the router and adjacent network traffic.

Affected Products

Tenda AC7 hardware (all units running the vulnerable firmware)
Tenda AC7 Firmware version 15.03.06.44
/goform/WriteFacMac endpoint served by the device web management interface

Discovery Timeline

2024-03-26 - CVE-2024-2897 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-2897

Vulnerability Analysis

The vulnerability is an OS command injection [CWE-78] in the router's HTTP management service. The formWriteFacMac handler processes requests submitted to the /goform/WriteFacMac endpoint, which is intended to write a factory MAC address to the device. The handler consumes the mac parameter from the request and passes it into a shell command without sanitizing metacharacters. As a result, characters such as ;, |, and backticks break out of the intended argument context and cause additional commands to run under the privileges of the web server process, typically root on consumer routers.

Root Cause

The root cause is unsanitized concatenation of attacker-controlled input into a system command string. The mac parameter is neither validated against a MAC address format nor escaped before invocation of a shell interpreter. This pattern is characteristic of many Tenda /goform/ handlers, where user input flows directly into system() or equivalent primitives inside the HTTP daemon binary.

Attack Vector

Exploitation requires network reachability to the router's management interface and low-privileged access. An attacker sends a crafted HTTP POST request to /goform/WriteFacMac containing a malicious mac parameter value. Successful exploitation grants arbitrary command execution, enabling persistence, credential theft from stored configuration, DNS hijacking, and pivoting into the LAN. The EPSS score of approximately 7.9% places this vulnerability in the top range of predicted-exploitation likelihood.

A proof-of-concept demonstrating the request structure and injection payload is documented in the public GitHub PoC for Tenda AC7. Refer to the linked write-up for the exact request format rather than relying on synthesized code.

Detection Methods for CVE-2024-2897

Indicators of Compromise

HTTP POST requests to /goform/WriteFacMac containing shell metacharacters (;, &, |, `, $() within the mac parameter.
Unexpected outbound connections from the router to attacker-controlled hosts following management-interface activity.
Modifications to router configuration, DNS settings, or firmware without administrator action.
New or unfamiliar processes running on the device, or web administration binaries spawning shells.

Detection Strategies

Inspect HTTP request logs from any device or network sensor positioned in front of the router for POST requests targeting /goform/WriteFacMac.
Alert on mac parameter values that do not match a strict MAC address regular expression such as ^[0-9A-Fa-f:]{17}$.
Correlate management-interface access with subsequent anomalous DNS resolutions or outbound command-and-control traffic from the router's WAN IP.

Monitoring Recommendations

Restrict router management access to a dedicated management VLAN and log all administrative sessions.
Ingest firewall and network telemetry into a centralized analytics platform to identify anomalous router-originated traffic.
Baseline expected router outbound destinations so that new connections trigger investigation.

How to Mitigate CVE-2024-2897

Immediate Actions Required

Disable remote (WAN-side) administration of the Tenda AC7 immediately and restrict LAN-side administration to trusted hosts.
Change default and existing administrator credentials, since the vulnerability requires low-privilege authentication.
Segment the router's management interface behind an access control list that only permits designated administrator workstations.
Treat any AC7 running firmware 15.03.06.44 reachable from untrusted networks as potentially compromised and inspect its configuration.

Patch Information

At the time of disclosure the vendor did not respond and no official patch has been published for firmware 15.03.06.44. Monitor the Tenda support portal for firmware updates addressing formWriteFacMac. If no fix is issued, consider replacing the device with a supported model that receives security updates.

Workarounds

Block external access to the router's HTTP management interface at the perimeter and via the router's own firewall rules.
Place the router behind a reverse proxy or upstream firewall that filters requests to /goform/WriteFacMac and rejects requests whose mac parameter fails MAC-address validation.
Rotate credentials for any account that could reach the management interface and enforce strong, unique passwords.
Where feasible, migrate to a router platform with an active security-response process.

bash

# Example perimeter filter rejecting requests to the vulnerable endpoint
# (Adjust interface and management subnet to your environment.)
iptables -A FORWARD -p tcp --dport 80 -d <router_ip> \
  -m string --algo bm --string "/goform/WriteFacMac" -j DROP
iptables -A FORWARD -p tcp --dport 443 -d <router_ip> \
  -m string --algo bm --string "/goform/WriteFacMac" -j DROP