PT-2024-6507 · Tenda · Tenda Fh1206

Published 2024-08-15 · Updated 2024-08-19 · CVE-2024-42973

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Tenda FH1206 version 02.03.01.35

Description The issue is related to a stack overflow in the fromSetlpBind function via the page parameter. This allows attackers to cause a Denial of Service (DoS) via a crafted POST request to the affected API endpoint. The vulnerability can be exploited by a remote attacker, potentially leading to service disruption.

Recommendations For Tenda FH1206 version 02.03.01.35, consider disabling the fromSetlpBind function until a patch is available to prevent exploitation via the page parameter in crafted POST requests. Restrict access to the vulnerable function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Stack Overflow

Weakness Enumeration

CWE-787

CWE-121

Related Identifiers

BDU:2024-07649

CVE-2024-42973

Affected Products

Tenda Fh1206

References · 8

• 🔥 https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/Tenda/FH1206/fromSetIpBind.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-42973 · Security Note
• https://bdu.fstec.ru/vul/2024-07649 · Security Note
• https://osv.dev/vulnerability/CVE-2024-42973 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1824171997200326857 · Twitter Post
• https://twitter.com/CVEnew/status/1824124327706472884 · Twitter Post
• https://twitter.com/cracbot/status/1825774894522708360 · Twitter Post
• https://t.me/cvedetector/3259 · Telegram Post