CVE-2024-57580
Published: 16 January 2025
Summary
CVE-2024-57580 is a critical-severity Out-of-bounds Write (CWE-787) vulnerability in Tenda Ac18 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 41.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2024-57580 is a stack-based buffer overflow vulnerability (CWE-787) affecting the Tenda AC18 router running firmware version V15.03.05.19. The flaw occurs in the formSetDeviceName function when processing the devName parameter, allowing an attacker to overwrite the stack with uncontrolled input. This issue was published on January 16, 2025, and carries a CVSS v3.1 base score of 9.8, indicating critical severity due to its network accessibility and high impact potential.
The vulnerability can be exploited by any remote, unauthenticated attacker with network access to the affected device, requiring low complexity and no user interaction. Successful exploitation enables high-impact consequences across confidentiality, integrity, and availability (C:H/I:H/A:H), potentially leading to full remote code execution, device takeover, or denial of service.
Analysis and proof-of-concept details are available in the GitHub repository at https://github.com/qijiale/Tenda/tree/main/7, though no official vendor advisories or patches are referenced in the available information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-53629
Vulnerability details
Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the devName parameter in the formSetDeviceName function.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack overflow in the web management interface (formSetDeviceName via devName parameter) enables remote code execution on the public-facing router application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 requires validation of inputs like the devName parameter to prevent stack overflows from uncontrolled data.
SI-16 enforces memory protections such as stack canaries or DEP to block exploitation of the stack overflow vulnerability.
SI-2 mandates timely identification and patching of flaws like this buffer overflow in router firmware.