PT-2024-5190 · Tenda · Tenda Fh1206

Published 2024-05-10 · Updated 2024-08-15 · CVE-2024-34944

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Tenda FH1206 version 1.2.0.8(8155) EN

Description: The issue is related to a stack-based buffer overflow via the list1 parameter at the "ip/goform/DhcpListClient" endpoint. This can be exploited by a remote attacker to impact the confidentiality, integrity, and availability of protected information. The vulnerability is associated with the fromDhcpListClient function and involves reading data beyond the buffer boundaries in memory.

Recommendations: For Tenda FH1206 version 1.2.0.8(8155) EN, consider restricting access to the "ip/goform/DhcpListClient" endpoint to minimize the risk of exploitation. Avoid using the list1 parameter in this endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

BDU:2024-05746

CVE-2024-34944

Affected Products

Tenda Fh1206

References · 6

• https://osv.dev/vulnerability/CVE-2024-34944 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-05746 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-34944 · Security Note
• https://vuldb.com/ru/?id.263850 · Note
• https://tendacn.com/hk/download/detail-2344.html · Note
• https://vulners.com/cve/CVE-2024-34944 · Note