CVE-2024-4492 Overview
CVE-2024-4492 is a stack-based buffer overflow vulnerability in the Tenda i21 wireless access point running firmware version 1.0.0.14(4656). The flaw resides in the formOfflineSet function handled by the /goform/setStaOffline endpoint. Attackers can trigger the overflow by manipulating the GO/ssidIndex argument. The vulnerability is remotely exploitable and public exploit details have been disclosed through VulDB entry #263081. The vendor was contacted about the issue but did not respond. The vulnerability maps to [CWE-121] Stack-based Buffer Overflow and [CWE-787] Out-of-bounds Write.
Critical Impact
A remote authenticated attacker can send a crafted request to /goform/setStaOffline to overflow the stack in formOfflineSet, leading to denial of service or arbitrary code execution on the device.
Affected Products
- Tenda i21 hardware device
- Tenda i21 firmware version 1.0.0.14(4656)
- Deployments exposing the web management interface at /goform/setStaOffline
Discovery Timeline
- 2024-05-05 - CVE-2024-4492 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-4492
Vulnerability Analysis
The vulnerability exists in the formOfflineSet handler within the Tenda i21 web management binary. This handler processes POST requests submitted to /goform/setStaOffline, which is used to force wireless clients offline based on SSID index parameters.
The handler reads the GO/ssidIndex argument from the incoming request and copies it into a fixed-size stack buffer without validating the input length. Because the destination buffer size is bounded but the source string length is not, an attacker can supply an oversized value that overwrites adjacent stack memory, including the saved return address.
An attacker on the same network as the device can send a single crafted HTTP request to trigger the condition. Successful exploitation grants control over program flow on a MIPS-based embedded target, enabling command execution in the context of the web server process. The vulnerability requires low-privilege authenticated access to the management interface.
Root Cause
The root cause is missing bounds checking when copying user-controlled input from the ssidIndex parameter into a stack-allocated buffer inside formOfflineSet. The function relies on unsafe string operations that do not enforce destination buffer limits, matching the [CWE-121] and [CWE-787] weakness patterns.
Attack Vector
The attack requires network access to the device's HTTP management interface and valid low-privilege credentials. The attacker submits a POST request to /goform/setStaOffline containing an overlong GO/ssidIndex value. No user interaction is required. Refer to the GitHub IoT Vulnerability Documentation and VulDB #263081 for the reproducer details.
Detection Methods for CVE-2024-4492
Indicators of Compromise
- HTTP POST requests to /goform/setStaOffline containing abnormally long ssidIndex or GO parameter values
- Unexpected reboots or crashes of the Tenda i21 web management daemon
- New outbound connections originating from the access point to unknown hosts following a management request
- Configuration changes on the device that were not initiated by an administrator
Detection Strategies
- Inspect web management traffic for requests to /goform/setStaOffline and alert on parameter lengths exceeding expected numeric SSID index values
- Correlate device availability loss with recent HTTP requests to goform endpoints on the management VLAN
- Baseline normal administrative activity on the i21 management interface and flag deviations in request frequency or source address
Monitoring Recommendations
- Forward router and switch logs adjacent to the access point into a central SIEM to detect scanning of /goform/ paths
- Monitor management VLAN egress for anomalous traffic originating from the access point itself
- Enable network-layer telemetry between wireless infrastructure and administrative workstations to detect lateral reconnaissance
How to Mitigate CVE-2024-4492
Immediate Actions Required
- Restrict access to the Tenda i21 web management interface to a dedicated administrative VLAN or jump host
- Change default and shared credentials on the device and enforce unique administrator passwords
- Disable remote WAN-side management if it is currently enabled on the device
- Audit device logs and configuration for signs of unauthorized modification
Patch Information
No vendor patch is available. According to the disclosure record, the vendor was contacted about CVE-2024-4492 but did not respond. Track the VulDB CTI entry #263081 for future updates and consider replacing the device with a supported model if remediation is not forthcoming.
Workarounds
- Place the access point behind a firewall that blocks inbound access to TCP ports serving the web management interface from untrusted networks
- Require VPN authentication before permitting any administrative access to the device
- Segment wireless management traffic from user and guest VLANs to reduce the pool of potential attackers
- Consider decommissioning affected units where segmentation and access controls cannot be enforced
# Example firewall rule to restrict access to the Tenda i21 management interface
# Allow only the admin subnet 10.10.50.0/24 to reach the device at 10.20.0.1
iptables -A FORWARD -s 10.10.50.0/24 -d 10.20.0.1 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -d 10.20.0.1 -p tcp --dport 80 -j DROP
iptables -A FORWARD -d 10.20.0.1 -p tcp --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
