PT-2024-6684 · Tenda · Tenda Fh1206

Yangshuangning

·

Published

2024-08-04

·

Updated

2024-08-22

·

CVE-2024-7707

CVSS v3.1

10

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions: Tenda FH1206 version 02.03.01.35
Description: A critical issue affects the formSafeEmailFilter function of the /goform/SafeEmailFilter file in the HTTP POST Request Handler component. The manipulation of the page argument leads to a stack-based buffer overflow. This issue can be exploited remotely, potentially impacting the confidentiality, integrity, and availability of protected information by sending a specially crafted POST request. The exploit has been disclosed publicly.
Recommendations: For Tenda FH1206 version 02.03.01.35, as a temporary workaround, consider disabling the formSafeEmailFilter function until a patch is available. Restrict access to the /goform/SafeEmailFilter endpoint to minimize the risk of exploitation. Avoid using the page parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Stack Overflow

Weakness Enumeration

CWE-787CWE-121

Related Identifiers

BDU:2024-07891
CVE-2024-7707

Affected Products

Tenda Fh1206