CVE-2024-57581
Published: 16 January 2025
Summary
CVE-2024-57581 is a critical-severity Out-of-bounds Write (CWE-787) vulnerability in Tenda Ac18 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 29.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2024-57581 is a stack overflow vulnerability (CWE-787) in the Tenda AC18 router firmware version V15.03.05.19. The flaw occurs in the formSetFirewallCfg function when processing the firewallEn parameter, which can be manipulated to overflow the stack.
The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it is exploitable remotely over the network by unauthenticated attackers with low complexity and no user interaction required. Exploitation could grant attackers high-impact control over confidentiality, integrity, and availability, likely enabling remote code execution on the affected device.
Advisories and further details, including potential proof-of-concept code, are available in the referenced GitHub repository at https://github.com/qijiale/Tenda/tree/main/8, published on 2025-01-16.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-53630
Vulnerability details
Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the firewallEn parameter in the formSetFirewallCfg function.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The stack overflow vulnerability in the formSetFirewallCfg function via the firewallEn parameter in the Tenda AC18 router's web interface enables remote code execution on a public-facing application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents stack overflow exploitation by validating the firewallEn parameter in formSetFirewallCfg to ensure bounds checking and reject malformed inputs.
Implements memory protections such as stack canaries, ASLR, or DEP to mitigate unauthorized code execution from stack overflows in the router firmware.
Requires timely identification, reporting, and patching of the specific stack overflow flaw in Tenda AC18 V15.03.05.19 firmware to eliminate the vulnerability.