CVE-2024-57578
Published: 16 January 2025
Summary
CVE-2024-57578 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Tenda Ac18 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 46.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-2 requires timely remediation of the stack overflow flaw in the formSetCfm function via patching to eliminate the vulnerability.
SI-10 enforces validation of the funcpara1 parameter to block oversized or malformed inputs causing the buffer overflow.
SI-16 implements memory protections such as stack canaries and non-executable stacks to prevent exploitation of the stack overflow for RCE.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack overflow in the Tenda AC18 router's web interface (formSetCfm function via funcpara1 parameter) enables remote code execution by exploiting a public-facing application.
NVD Description
Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the funcpara1 parameter in the formSetCfm function.
Deeper analysisAI
CVE-2024-57578 is a stack overflow vulnerability in the Tenda AC18 router, specifically version V15.03.05.19. The flaw occurs in the formSetCfm function through the funcpara1 parameter, corresponding to CWE-787 (Out-of-bounds Write) and CWE-120 (Buffer Copy without Checking Size of Input).
The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it can be exploited by unauthenticated attackers on an adjacent network with low complexity and no user interaction required. Exploitation could grant high-impact control over confidentiality, integrity, and availability, likely enabling remote code execution or system compromise on the affected device.
Mitigation guidance is available in the referenced advisory at https://github.com/qijiale/Tenda/blob/main/5/Readme.md.
Details
- CWE(s)