CVE-2024-57581: Critical Stack Overflow in Tenda AC18

CVE-2024-57581 is a critical severity stack overflow flaw (CVSS 9.8) in Tenda AC18 firmware V15.03.05.19. The firewallEn parameter of the formSetFirewallCfg function is mishandled. We could not confirm a fixed version, so check Tenda's download page for newer firmware and limit access to the admin interface.

What's affected

The record says Tenda AC18 V15.03.05.19 contains a stack overflow via the firewallEn parameter in the formSetFirewallCfg function. That function is the firewall configuration handler, and the parameter carries the firewall enable flag.

This is one of a group of Tenda AC18 entries from the same researcher series, CVE-2024-57575 and CVE-2024-57579 through CVE-2024-57583. The write-up links to Tenda's firmware download page for the affected version. No Tenda advisory is linked, so a fixed version is not confirmed. Treat V15.03.05.19 as affected, and check Tenda's download page for any newer firmware for your exact hardware revision. Tenda sells several variants under similar names, so match the model and hardware version printed on the router label before you download anything.

How to check if you're exposed

Open the router's admin page and read the firmware version on the system status or upgrade screen. If it reads V15.03.05.19, you have the version in the record.

Then check exposure.

• Is remote web management enabled? On many routers this is a single checkbox. Turn it off unless you have a reason.
• Which devices can reach the admin page from the inside? Guest devices and smart home gadgets on the main network can all send requests to it.
• Is the admin password still the default or a weak one?

The vector in the record shows network access with no privileges required. The write-ups for this firmware show requests sent to the router's web interface, and some include a session cookie, so whether a login is needed may depend on the version. Do not treat the login page as a safe barrier.

What to do now

1. Check Tenda's download page for the AC18 and install firmware newer than V15.03.05.19 if it exists for your hardware revision.
2. Turn off remote web management so the admin interface cannot be reached from the internet.
3. Set a long, unique admin password and a strong Wi-Fi password.
4. Put guests and smart devices on a separate guest network, if the router allows it.
5. Replace the router if Tenda has stopped issuing firmware for it, since a model with no updates will not get a fix for this.
6. Check the router now and then for settings you did not make, such as DNS servers or port forwards.

Why it matters

The record classes this as CWE-787. A stack based buffer overflow happens when code copies input of unknown length into a fixed size area on the stack. The write-up says the value is copied with strcpy into a stack buffer, with no size check before the copy. Extra bytes spill over into neighbouring data and, in the worst case, into the saved return address. The usual result is a crash and a reboot of the router. With more work, an attacker may take control of execution, as the write-ups for this firmware family describe.

The vector in the record shows network access, low complexity and no privileges, with high impact on confidentiality, integrity and availability, so the score is 9.8. The KEV flag in the record is false. Consumer routers repeat this class of bug often, because the web handlers are written in C, parse many parameters and rarely get a security review. The practical advice is to keep the admin interface off the internet, update when firmware exists and replace devices that no longer get updates.

Quick check

Sources

• Researcher write-up for CVE-2024-57581

Last reviewed: 19 October 2026.