Tenda FH1202 QuickIndex formQuickIndex stack-based overflow

CVE-2024-2985

What is CVE-2024-2985?

The Tenda FH1202 router has a vulnerability in the function formQuickIndex located in the file /goform/QuickIndex. An attacker can exploit this vulnerability by manipulating the argument PPPOEPassword, leading to a stack-based buffer overflow. This issue can be triggered remotely, allowing unauthorized individuals to execute malicious code or disrupt the router's operations. Despite early disclosure to the vendor, no response has been received, raising concerns about the urgency of addressing this security flaw.

References