CVE-2024-57582
Published: 16 January 2025
Summary
CVE-2024-57582 is a critical-severity Out-of-bounds Write (CWE-787) vulnerability in Tenda Ac18 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 29.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2024-57582 is a stack-based buffer overflow vulnerability (CWE-787) affecting the Tenda AC18 router running firmware version V15.03.05.19. The issue resides in the formSetPPTPServer function, where the startIP parameter triggers the overflow due to insufficient bounds checking on user-supplied input.
The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it is exploitable remotely over the network with low complexity, no authentication or user interaction required. Attackers can send a specially crafted request to the affected endpoint, potentially leading to arbitrary code execution, denial of service, or full compromise of the device, granting high impacts on confidentiality, integrity, and availability.
Mitigation details and additional technical analysis are available in the referenced advisory at https://github.com/qijiale/Tenda/tree/main/9. Security practitioners should check for firmware updates from Tenda and apply network segmentation or exposure controls for affected devices until patched.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-53631
Vulnerability details
Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the startIP parameter in the formSetPPTPServer function.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack overflow in the web interface (formSetPPTPServer) of the public-facing Tenda AC18 router enables remote code execution via exploitation of a public-facing application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely identification, reporting, and correction of the stack overflow flaw via firmware updates, directly mitigating the vulnerability as recommended in the advisory.
Mandates information input validation mechanisms with bounds checking on parameters like startIP to prevent stack-based buffer overflows from insufficient validation.
Implements memory protection mechanisms such as stack canaries and non-executable memory to block arbitrary code execution from stack overflow exploits.