cbcvebase.
CVE-2024-2811
published 2024-03-22

CVE-2024-2811: A vulnerability was found in Tenda AC15 15.03.20_multi and classified as critical. Affected by this issue is the function formWifiWpsStart of the file…

PriorityP267critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.54%
72.0th percentile
A vulnerability was found in Tenda AC15 15.03.20_multi and classified as critical. Affected by this issue is the function formWifiWpsStart of the file /goform/WifiWpsStart. The manipulation of the argument index leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-257666 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Affected

2 ranges
VendorProductVersion rangeFixed in
tendaac15——
tendaac15_firmware——

Detection & IOCsextracted from sources · hover to see the quote

url/goform/WifiWpsStart↗
snort
alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Tenda WifiWpsStart index Parameter Buffer Overflow Attempt (CVE-2025-45429, CVE-2024-2896, CVE-2024-2811, CVE-2024-2706)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:20; content:"/goform/WifiWpsStart"; fast_pattern; http.request_body; content:"index|3d|"; pcre:"/^[^&]{100,}(?:&|$)/R"; reference:cve,2025-45429; reference:url,github.com/SolitaryGrass/IoT_vuln/blob/main/tenda/AC6/AC6V2.0RTL_V15.03.06.23/formWifiWpsStart/poc.py; reference:cve,2024-2811; reference:cve,2024-2706; reference:cve,2024-2896; classtype:web-application-attack; sid:2064111; rev:1; metadata:affected_product Tenda, attack_target Networking_Equipment, tls_state plaintext, created_at 2025_08_22, cve CVE_2025_45429_CVE_2024_2896_CVE_2024_2811_CVE_2024_2706, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2025_08_22, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)
  • →Exploit targets HTTP POST requests to /goform/WifiWpsStart with an oversized `index` parameter (>=100 chars before & or end of body), triggering a stack-based buffer overflow in Tenda AC15 firmware. ↗
  • →Detection should match HTTP POST method, URI exactly 20 bytes (/goform/WifiWpsStart), request body containing `index=` (hex: index|3d|) followed by 100+ non-ampersand characters.
  • →Traffic is expected in plaintext (not TLS); deploy detection at perimeter and internally targeting destination IP.
  • →PoC exploit code is publicly available on GitHub and should be used as a reference for payload structure.
  • ·The Snort/Suricata rule (ET sid:2064111) covers multiple CVEs simultaneously (CVE-2025-45429, CVE-2024-2896, CVE-2024-2811, CVE-2024-2706); a true positive may correspond to any of these vulnerabilities, not exclusively CVE-2024-2811.
  • ·Affected firmware version is specifically Tenda AC15 15.03.20_multi; the rule may fire on other Tenda models sharing the same endpoint (AC6 referenced in PoC URL).

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.