CVE-2024-2560 in AC18
Summary
by MITRE • 03/17/2024
A vulnerability classified as problematic was found in Tenda AC18 15.03.05.05. Affected by this vulnerability is the function fromSysToolRestoreSet of the file /goform/SysToolRestoreSet. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257059. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 04/14/2025
This vulnerability resides within the Tenda AC18 router firmware version 15.03.05.05, specifically targeting the SysToolRestoreSet function located in the /goform/SysToolRestoreSet file path. The issue manifests as a cross-site request forgery vulnerability that allows remote attackers to manipulate the device's configuration without proper authentication. The vulnerability stems from insufficient validation of the origin of requests sent to the affected endpoint, enabling malicious actors to craft requests that appear to originate from legitimate administrative sessions. This flaw represents a critical security weakness in the router's access control mechanisms, as it permits unauthorized modification of system settings through forged requests that exploit the trust relationship between the device and its administrative interface. The vulnerability's classification as problematic indicates significant risk to network security and device integrity, particularly given the router's role as a primary network gateway.
The technical implementation of this CSRF vulnerability occurs through the manipulation of the fromSysToolRestoreSet function, which handles system restoration commands within the router's web-based management interface. When a user accesses the administrative web interface, the device establishes a session that is typically validated through cookies or tokens. However, the vulnerable implementation fails to properly verify that requests originate from legitimate administrative sessions, allowing attackers to construct malicious web pages or send crafted HTTP requests that trigger unintended system operations. This flaw enables attackers to perform actions such as resetting the device to factory defaults, modifying network configurations, or changing administrative credentials without requiring valid authentication. The vulnerability's remote exploitability means that attackers can target affected devices from outside the local network, potentially compromising entire network infrastructures through unauthorized access to critical router functions.
The operational impact of this vulnerability extends beyond simple unauthorized access, as it fundamentally undermines the security posture of networks relying on affected Tenda AC18 devices. Attackers can leverage this vulnerability to perform complete system resets, potentially disrupting network services and forcing administrators to reconfigure devices from scratch. The vulnerability also enables more sophisticated attacks such as persistent modification of network settings, creation of backdoor access points, or configuration changes that could facilitate further exploitation of the network. Given that the exploit has been publicly disclosed and is reportedly available for use, the risk to affected networks is immediate and significant. The lack of vendor response to early disclosure attempts suggests that affected organizations may not receive timely patches or security updates, leaving networks exposed to ongoing exploitation attempts. This vulnerability directly relates to CWE-352, which specifically addresses Cross-Site Request Forgery issues in web applications and network devices.
Organizations should immediately implement network segmentation and access controls to limit exposure of affected devices to untrusted networks. The most effective immediate mitigation involves disabling remote administration capabilities for affected devices and restricting access to the administrative interface to trusted networks only. Network administrators should also implement robust monitoring of network traffic for suspicious requests targeting the vulnerable endpoint and establish procedures for regular firmware updates. The vulnerability demonstrates the importance of implementing proper input validation and request origin verification mechanisms, which aligns with ATT&CK technique T1566 for credential harvesting and T1071 for application layer protocol usage. Security teams should also consider implementing web application firewalls to detect and block malicious requests targeting the vulnerable SysToolRestoreSet endpoint. Regular security audits of network infrastructure should include verification of firmware versions and patch status for all network devices, as this vulnerability highlights the critical need for maintaining up-to-date security configurations. Organizations with affected devices should also consider implementing network access control measures that prevent unauthorized users from accessing administrative interfaces entirely, particularly for network devices that do not require remote management capabilities.