CVE-2024-32317 Overview
CVE-2024-32317 is a stack overflow vulnerability affecting Tenda AC10 v4.0 routers running firmware versions V16.03.10.13 and V16.03.10.20. The flaw resides in the formWanParameterSetting function, where the adslPwd parameter is copied without proper bounds checking. An unauthenticated remote attacker can send a crafted HTTP request to overflow the stack and disrupt the device. The issue is classified under [CWE-121: Stack-based Buffer Overflow].
Critical Impact
Remote attackers can trigger a stack-based buffer overflow on affected Tenda AC10 routers, leading to denial of service and potential code execution on the device.
Affected Products
- Tenda AC10 hardware version 4.0
- Tenda AC10 firmware V16.03.10.13
- Tenda AC10 firmware V16.03.10.20
Discovery Timeline
- 2024-04-17 - CVE-2024-32317 published to NVD
- 2025-03-17 - Last updated in NVD database
Technical Details for CVE-2024-32317
Vulnerability Analysis
The vulnerability exists in the formWanParameterSetting handler within the Tenda AC10 web management interface. This function processes WAN configuration parameters submitted through the router's HTTP service. The adslPwd parameter, used to store the ADSL password during WAN setup, is copied into a fixed-size stack buffer without length validation.
When an attacker supplies an oversized adslPwd value, the copy operation writes past the buffer boundary. This corrupts adjacent stack data including saved return addresses. The result is a stack-based buffer overflow [CWE-121] that crashes the HTTP server and may permit arbitrary code execution on the MIPS-based device.
Exploitation does not require authentication because the affected handler is reachable on the LAN management interface and, in misconfigured deployments, the WAN interface. The EPSS score of 0.253% reflects current observed exploit activity but does not diminish the technical exposure on unpatched devices.
Root Cause
The root cause is missing input length validation in the formWanParameterSetting function. The handler accepts the adslPwd POST parameter and copies it into a local stack buffer using an unbounded string copy. No size check ensures the supplied value fits within the destination buffer.
Attack Vector
The attack vector is network-based. An attacker sends a specially crafted HTTP POST request to the router's web administration endpoint with an oversized adslPwd field. The request reaches formWanParameterSetting, triggering the overflow on stack frame return.
No verified exploit code is published in NVD-referenced advisories. Technical details and a proof-of-concept walkthrough are documented in the GitHub PoC Repository.
Detection Methods for CVE-2024-32317
Indicators of Compromise
- Unexpected reboots or crashes of the router HTTP daemon (httpd) following inbound HTTP POST traffic to WAN configuration endpoints.
- HTTP POST requests to the router management interface containing abnormally long adslPwd parameter values.
- Loss of router management access while the device remains powered, indicating possible service crash from overflow attempts.
Detection Strategies
- Inspect network traffic to router management interfaces for HTTP POST bodies invoking formWanParameterSetting with adslPwd values exceeding typical password lengths.
- Deploy IDS or IPS signatures matching oversized parameter payloads targeting Tenda AC10 administrative URIs.
- Correlate router availability monitoring with inbound HTTP traffic patterns to identify probe attempts.
Monitoring Recommendations
- Monitor router syslog output for repeated HTTP service restarts or watchdog-triggered reboots.
- Track inbound connections to TCP port 80 and 443 of router management interfaces from unexpected sources.
- Alert on any external (WAN-side) connections to administrative endpoints when remote management should be disabled.
How to Mitigate CVE-2024-32317
Immediate Actions Required
- Disable remote (WAN-side) web administration on affected Tenda AC10 routers until a vendor patch is available.
- Restrict LAN-side access to the router management interface to trusted administrative hosts only.
- Inventory all Tenda AC10 devices and identify those running firmware V16.03.10.13 or V16.03.10.20.
- Replace end-of-life Tenda AC10 v4.0 devices with currently supported equipment if no firmware update is provided by the vendor.
Patch Information
No vendor advisory or patched firmware version is referenced in NVD for CVE-2024-32317 at the time of publication. Administrators should consult the Tenda support portal for firmware updates and apply any newer firmware release that supersedes versions V16.03.10.13 and V16.03.10.20.
Workarounds
- Block external access to the router's HTTP and HTTPS management ports using upstream firewall rules.
- Segment router management traffic onto a dedicated VLAN accessible only to authorized administrators.
- Change default administrative credentials and rotate them regularly to reduce risk from chained attacks.
- Consider replacing affected devices with vendor-supported alternatives if firmware remediation is not released.
# Configuration example: block WAN-side access to router admin from upstream firewall
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -i <wan_iface> -j DROP
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -i <wan_iface> -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
