Cyber Resilience

CVE-2024-57575

Critical

Published: 16 January 2025

Published
16 January 2025
Modified
03 February 2025
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0043 63.3th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-57575 is a critical-severity Out-of-bounds Write (CWE-787) vulnerability in Tenda Ac18 Firmware. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 36.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Deeper analysis

CVE-2024-57575 is a stack overflow vulnerability (CWE-787) affecting the Tenda AC18 router in version V15.03.05.19. The flaw occurs in the form_fast_setting_wifi_set function when processing a specially crafted ssid parameter, which can overwrite the stack buffer and lead to unintended control flow hijacking.

The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it is exploitable remotely over the network with low attack complexity, no required privileges or user interaction, and unchanged impact scope. Unauthenticated attackers can send malformed requests to the vulnerable endpoint, potentially achieving remote code execution with high impacts on confidentiality, integrity, and availability.

Mitigation details are available in the referenced advisory at https://github.com/qijiale/Tenda/blob/main/1/Readme.md, published on 2025-01-16.

EU & UK References

Vulnerability details

Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the ssid parameter in the form_fast_setting_wifi_set function.

CWE(s)
CWE-787

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
attack.mitre.org →
Why these techniques?

Stack overflow in the router's web management interface (form_fast_setting_wifi_set via ssid parameter) enables remote code execution on a public-facing application.

CVEs Like This One

CVE-2024-57580Same product: Tenda Ac18
CVE-2024-57579Same product: Tenda Ac18
CVE-2024-57581Same product: Tenda Ac18
CVE-2024-57582Same product: Tenda Ac18
CVE-2024-57578Same product: Tenda Ac18
CVE-2025-63835Same product: Tenda Ac18
CVE-2025-11122Same product: Tenda Ac18
CVE-2025-14993Same product: Tenda Ac18
CVE-2025-11326Same product: Tenda Ac18
CVE-2025-11327Same product: Tenda Ac18

Affected Assets

tenda
ac18 firmware
15.03.05.19

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly prevents stack overflow by validating the length and format of the ssid parameter in the form_fast_setting_wifi_set function.

SI-16 Memory Protection good match
prevent

Implements memory protections such as stack canaries and non-executable stacks to block control flow hijacking from the stack overflow.

SI-2 Flaw Remediation good match
prevent

Mandates identification, reporting, and patching of the specific stack overflow flaw to eliminate the vulnerability.

References