Tenda FH1205 execCommand formexeCommand stack-based overflow
CVE-2024-3008

8.8HIGH

Key Information:

Vendor: Tenda
Status: Fh1205
Vendor: CVE Published:; 27 March 2024

Badges

👾 Exploit Exists🟡 Public PoC

Summary

A security vulnerability has been identified in the Tenda FH1205 router, specifically in the formexeCommand function located in the /goform/execCommand file. This issue stems from improper handling of the cmdinput argument, leading to a stack-based buffer overflow. The exploit can be executed remotely, potentially allowing attackers to gain unauthorized access or control over the device. Although the vulnerability has been publicly disclosed, communication with the vendor regarding this issue has not been acknowledged. Users of the affected product are advised to take immediate precautions to safeguard their devices.

Affected Version(s)

FH1205 2.0.0.7(775)

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-3008 - Proof of Concept