Stack-Based Buffer Overflow in Tenda F1202 Router

CVE-2024-3877

Summary

A critical vulnerability has been identified in the Tenda F1202 router model, specifically affecting version 1.2.0.20(408). This vulnerability occurs within the fromqossetting function located in the /goform/fromqossetting file. By manipulating the qos argument, an attacker can exploit a stack-based buffer overflow, potentially allowing for unauthorized remote access and control of the device. The vulnerability has been publicly disclosed and could be actively exploited if left unpatched. Despite attempts to notify Tenda regarding this security risk, no response has been received from the vendor to address the issue. It is essential for users of the Tenda F1202 router to take immediate action to mitigate this risk.

References