PT-2024-23540 · Tenda · Tenda Fh1202

Published 2024-03-29 · Updated 2024-08-15 · CVE-2024-30639

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Tenda F1202 version 1.2.0.20(408)

Description The issue is a stack overflow vulnerability in the page parameter of the fromAddressNat function. This vulnerability can be exploited, potentially allowing attackers to execute arbitrary code.

Recommendations For Tenda F1202 version 1.2.0.20(408), consider disabling the fromAddressNat function until a patch is available. Restrict access to the vulnerable function to minimize the risk of exploitation. Avoid using the page parameter in the affected function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

CVE-2024-30639

Affected Products

Tenda Fh1202

References · 5

• 🔥 https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/F/F1202/fromAddressNat_page.md · Exploit
• https://osv.dev/vulnerability/CVE-2024-30639 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-30639 · Security Note
• https://t.me/cvenotify/90823 · Telegram Post
• https://twitter.com/CVEnew/status/1773709801928745434 · Twitter Post