CVE-2024-0932 in AC10U
Summary
by MITRE • 01/26/2024
A vulnerability, which was classified as critical, has been found in Tenda AC10U 15.03.06.49_multi_TDE01. This issue affects the function setSmartPowerManagement. The manipulation of the argument time leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252137 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 02/19/2024
The vulnerability identified as CVE-2024-0932 represents a critical stack-based buffer overflow in the Tenda AC10U router firmware version 15.03.06.49_multi_TDE01. This flaw resides within the setSmartPowerManagement function, which handles time-related arguments that control smart power management features of the device. The buffer overflow occurs when the argument time is manipulated beyond the allocated stack buffer boundaries, creating a potential exploitation vector that could allow remote code execution. The vulnerability's classification as critical stems from its remote exploitability and the fact that public exploitation methods have already been disclosed, making it immediately actionable by threat actors.
The technical nature of this vulnerability aligns with CWE-121, which describes stack-based buffer overflow conditions where insufficient bounds checking allows attackers to overwrite adjacent stack memory locations. The attack surface is particularly concerning because it operates through remote network access without requiring authentication, as indicated by the vulnerability's remote exploitability. The specific function setSmartPowerManagement suggests this relates to power management controls that may be exposed through web interfaces or API endpoints, making it accessible to attackers who can send malformed time parameters to trigger the overflow condition.
From an operational perspective, this vulnerability creates significant risk for network infrastructure security as it allows unauthorized remote code execution on affected Tenda AC10U devices. The implications extend beyond simple device compromise, as compromised routers can serve as entry points for broader network infiltration, acting as pivot points for lateral movement and potentially enabling persistent access to corporate or residential networks. The lack of vendor response to early disclosure attempts compounds the risk, leaving users without official patches or mitigation guidance during the active exploitation period.
The attack vector for this vulnerability follows patterns consistent with ATT&CK technique T1210, which involves exploiting weaknesses in remote services to gain system access. Given the router's role as a network gateway, successful exploitation could enable attackers to modify routing tables, intercept network traffic, or establish backdoor access that persists across reboots. The stack-based nature of the overflow means that attackers can potentially overwrite return addresses and function pointers, allowing for arbitrary code execution with the privileges of the affected service. Organizations should immediately implement network segmentation, disable unnecessary remote access to router management interfaces, and consider deploying intrusion detection systems to monitor for exploitation attempts. The vulnerability's public disclosure status necessitates urgent remediation efforts, as the window for defensive action is limited by the availability of working exploits in the wild.