Stack Overflow Vulnerability in Tenda FH1201 by Tenda Technology
CVE-2024-42950

7.5HIGH

Key Information:

Vendor

Tenda
Status
Fh1201 Firmware
Vendor
CVE Published:
15 August 2024

What is CVE-2024-42950?

The Tenda FH1201, specifically version v1.2.0.14, is susceptible to a stack overflow vulnerability that can be exploited through a malformed POST request directed at the fromSafeClientFilter function. This flaw arises from improper handling of the Go parameter, allowing attackers to disrupt the normal operation of the device and potentially lead to a Denial of Service (DoS) condition. Security measures should be enacted to protect against such vulnerabilities, ensuring user devices remain secure from unauthorized disruptions.

References

https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main...
ExploitThird Party Advisory

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.