PT-2024-23184 · Tenda · Tenda Fh1205

Wxhwxhwxh_Mie · Published 2024-03-27 · Updated 2025-01-15 · CVE-2024-3006

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Tenda FH1205 version 2.0.0.7(775)

Description A critical vulnerability was found in the Tenda FH1205, affecting the function fromSetRouteStatic of the file /goform/fromRouteStatic. The manipulation of the argument entrys leads to a stack-based buffer overflow. The attack can be initiated remotely. The vendor was contacted about this disclosure but did not respond.

Recommendations For Tenda FH1205 version 2.0.0.7(775), update the firmware as soon as possible. If an update is unavailable, limit router access to minimize the risk of exploitation. As a temporary workaround, consider restricting access to the /goform/fromRouteStatic endpoint until a patch is available. Avoid using the entrys argument in the affected function until the issue is resolved.

Exploit

Fix

Memory Corruption

Stack Overflow

Weakness Enumeration

CWE-787

CWE-121

Related Identifiers

CVE-2024-3006

Affected Products

Tenda Fh1205

References · 10

• 🔥 https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1205/fromRouteStatic.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-3006 · Security Note
• https://osv.dev/vulnerability/CVE-2024-3006 · Vendor Advisory
• https://twitter.com/oktsec/status/1775162371293520317 · Twitter Post
• https://twitter.com/CVEnew/status/1773121022574936104 · Twitter Post
• https://t.me/cvenotify/74916 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1773143269108511197 · Twitter Post
• https://vuldb.com/?ctiid.258292 · Note
• https://vuldb.com/?submit.301485 · Note
• https://vuldb.com/?id.258292 · Note