CVE-2024-57579
Published: 16 January 2025
Summary
CVE-2024-57579 is a critical-severity Out-of-bounds Write (CWE-787) vulnerability in Tenda Ac18 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 36.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the stack overflow vulnerability in the formSetClientState function by identifying, reporting, and applying firmware patches.
Enforces validation of the limitSpeedUp parameter at input points to prevent out-of-bounds writes causing stack overflows.
Implements memory protections like non-executable stacks and ASLR to mitigate arbitrary code execution from successful stack overflows.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The stack overflow vulnerability in the formSetClientState function via the limitSpeedUp parameter in the Tenda AC18 router's web interface enables remote code execution on a public-facing application.
NVD Description
Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the limitSpeedUp parameter in the formSetClientState function.
Deeper analysisAI
CVE-2024-57579 is a stack overflow vulnerability in the Tenda AC18 router, specifically version V15.03.05.19. The flaw occurs in the formSetClientState function when processing the limitSpeedUp parameter, classified under CWE-787 (Out-of-bounds Write). It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity.
The vulnerability enables remote exploitation over the network by unauthenticated attackers with low complexity and no user interaction required. Successful attacks can result in high impacts to confidentiality, integrity, and availability, potentially allowing arbitrary code execution, data compromise, or denial of service on the affected device.
Mitigation details are available in the referenced GitHub repository at https://github.com/qijiale/Tenda/tree/main/6, published on 2025-01-16. No vendor patches or additional advisories are specified in the available information.
Details
- CWE(s)