CVE-2024-4164: Tenda G3 Buffer Overflow Vulnerability

CVE-2024-4164 Overview

A critical stack-based buffer overflow vulnerability has been identified in Tenda G3 router firmware version 15.11.0.17(9502). This vulnerability exists in the formModifyPppAuthWhiteMac function located in the /goform/ModifyPppAuthWhiteMac endpoint. Attackers can exploit this flaw by manipulating the pppoeServerWhiteMacIndex argument, allowing remote code execution without authentication.

Critical Impact

This vulnerability enables unauthenticated remote attackers to execute arbitrary code on affected Tenda G3 routers, potentially leading to complete device compromise, network infiltration, and persistent access to enterprise networks.

Affected Products

• Tenda G3 Firmware version 15.11.0.17(9502)_CN
• Tenda G3 Hardware

Discovery Timeline

• 2024-04-25 - CVE-2024-4164 published to NVD
• 2025-03-05 - Last updated in NVD database

Technical Details for CVE-2024-4164

Vulnerability Analysis

This vulnerability is a stack-based buffer overflow (CWE-121) that occurs when the formModifyPppAuthWhiteMac function fails to properly validate the length of data supplied through the pppoeServerWhiteMacIndex parameter. When an oversized input is provided, the function copies this data onto the stack without adequate bounds checking, resulting in memory corruption that can overwrite return addresses and other critical stack data.

The vulnerability allows attackers to achieve arbitrary code execution by crafting malicious HTTP requests to the affected endpoint. Since no authentication is required and the attack can be performed over the network, this represents a significant security risk for any organization deploying these devices. The vendor was contacted early about this disclosure but did not respond in any way.

Root Cause

The root cause is improper input validation in the formModifyPppAuthWhiteMac function. The function accepts user-controlled input through the pppoeServerWhiteMacIndex parameter and copies it to a fixed-size stack buffer without verifying that the input length does not exceed the buffer capacity. This classic stack-based buffer overflow pattern (CWE-787: Out-of-bounds Write) allows attackers to corrupt adjacent memory regions and hijack program execution flow.

Attack Vector

The attack is initiated remotely via HTTP requests to the /goform/ModifyPppAuthWhiteMac endpoint. An attacker sends a specially crafted POST request containing an oversized pppoeServerWhiteMacIndex parameter. The malicious payload overflows the stack buffer, allowing the attacker to overwrite the return address and redirect execution to attacker-controlled shellcode.

The exploit has been publicly disclosed. Technical details and analysis are available through the GitHub IoT Vulnerability Report. Additional information can be found in VulDB #261983.

Detection Methods for CVE-2024-4164

Indicators of Compromise

• HTTP POST requests to /goform/ModifyPppAuthWhiteMac containing abnormally large pppoeServerWhiteMacIndex parameter values
• Unexpected router crashes, reboots, or service disruptions following HTTP traffic
• Anomalous outbound connections from router management interfaces
• Suspicious modifications to router configuration or firmware

Detection Strategies

• Deploy network intrusion detection rules to identify HTTP requests to /goform/ModifyPppAuthWhiteMac with oversized parameter values
• Monitor for buffer overflow signatures in web application firewall (WAF) logs targeting Tenda device management endpoints
• Implement anomaly detection for HTTP POST request sizes to router management interfaces
• Configure alerts for unexpected router behavior patterns including service restarts and configuration changes

Monitoring Recommendations

• Enable verbose logging on network perimeter devices to capture HTTP traffic destined for Tenda G3 router management interfaces
• Establish baseline behavioral patterns for router management traffic and alert on deviations
• Monitor for lateral movement attempts originating from router IP addresses
• Regularly audit router firmware versions to identify vulnerable deployments

How to Mitigate CVE-2024-4164

Immediate Actions Required

• Restrict network access to the router management interface using firewall rules or access control lists
• Isolate Tenda G3 routers from untrusted network segments
• Disable remote management access if not required for operations
• Implement network segmentation to limit potential impact of router compromise

Patch Information

No official patch information is available from Tenda. The vendor was contacted early about this disclosure but did not respond in any way. Organizations should consider replacing affected devices with alternatives from vendors with responsive security practices. Monitor VulDB CTI #261983 and Tenda's official channels for any future updates.

Workarounds

• Implement strict access control lists (ACLs) to permit management interface access only from trusted administrator IP addresses
• Deploy a web application firewall (WAF) in front of the router management interface to filter malicious requests
• Use VPN or out-of-band management networks for router administration
• Consider replacing vulnerable devices with actively supported alternatives given the vendor's lack of response

# Example firewall rule to restrict management access (adapt to your environment)
# Block external access to Tenda management interface
iptables -A FORWARD -d <ROUTER_MGMT_IP> -p tcp --dport 80 -j DROP
iptables -A FORWARD -d <ROUTER_MGMT_IP> -p tcp --dport 443 -j DROP
# Allow management only from trusted admin network
iptables -I FORWARD -s <ADMIN_NETWORK>/24 -d <ROUTER_MGMT_IP> -p tcp --dport 80 -j ACCEPT