PT-2024-23083 · Tenda · Tenda Fh1202

Wxhwxhwxh_Tutu · Published 2024-03-27 · Updated 2025-01-14 · CVE-2024-2985

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Tenda FH1202 version 1.2.0.14(408)

Description A critical issue affects the function formQuickIndex of the file /goform/QuickIndex, where the manipulation of the PPPOEPassword argument leads to a stack-based buffer overflow. This can be initiated remotely, and an exploit has been publicly disclosed, making it potentially usable. The vendor was contacted about this issue but did not respond.

Recommendations For Tenda FH1202 version 1.2.0.14(408), as a temporary workaround, consider disabling the formQuickIndex function until a patch is available. Restrict access to the /goform/QuickIndex file to minimize the risk of exploitation. Avoid using the PPPOEPassword argument in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Stack Overflow

Weakness Enumeration

CWE-787

CWE-121

Related Identifiers

CVE-2024-2985

Affected Products

Tenda Fh1202

References · 8

• 🔥 https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1202/formQuickIndex.md · Exploit
• https://osv.dev/vulnerability/CVE-2024-2985 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-2985 · Security Note
• https://t.me/cvenotify/107308 · Telegram Post
• https://twitter.com/CVEnew/status/1773096365662580964 · Twitter Post
• https://vuldb.com/?id.258154 · Note
• https://vuldb.com/?ctiid.258154 · Note
• https://vuldb.com/?submit.301276 · Note