CVE-2024-12002
📋 TL;DR
This vulnerability in Tenda FH series routers allows remote attackers to cause a denial-of-service (DoS) by sending specially crafted requests to the /goform/GetIPTV endpoint. The null pointer dereference in the websReadEvent function can crash the device when manipulated Content-Length values are provided. Affected users include anyone running vulnerable Tenda FH451, FH1201, FH1202, or FH1206 routers.
💻 Affected Systems
- Tenda FH451
- Tenda FH1201
- Tenda FH1202
- Tenda FH1206
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote unauthenticated attacker causes permanent device crash requiring physical reset or power cycle, disrupting all network connectivity.
Likely Case
Temporary service disruption causing router reboot or network downtime until device restarts automatically.
If Mitigated
Minimal impact with proper network segmentation and firewall rules blocking external access to router management interfaces.
🎯 Exploit Status
Public exploit code available on GitHub. Simple HTTP request manipulation required. No authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.tenda.com.cn/
Restart Required: No
Instructions:
Check Tenda website for firmware updates. If update available: 1. Download latest firmware from vendor site. 2. Log into router admin interface. 3. Navigate to firmware update section. 4. Upload and apply new firmware. 5. Wait for router to reboot.
🔧 Temporary Workarounds
Block External Access to Management Interface
allConfigure firewall to block inbound connections to router web interface (typically port 80/443) from external networks.
Disable Remote Management
allTurn off remote management feature in router settings to prevent external access to vulnerable endpoint.
🧯 If You Can't Patch
- Segment network to isolate routers from untrusted networks
- Implement strict firewall rules blocking all external access to router management interfaces
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface. If version date is 20241129 or earlier, device is vulnerable.Check Version:
Log into router web interface and check System Status or Firmware Version page.Verify Fix Applied:
After firmware update, verify version shows date after 20241129. Test by attempting to send crafted request to /goform/GetIPTV endpoint.📡 Detection & Monitoring
Log Indicators:
- Multiple connection attempts to /goform/GetIPTV
- Router crash/reboot events in system logs
- Unusual Content-Length values in HTTP requests
Network Indicators:
- HTTP POST requests to /goform/GetIPTV with manipulated Content-Length headers
- Sudden loss of connectivity to router management interface
SIEM Query:
http.url:"/goform/GetIPTV" AND http.method:POST AND (http.content_length:<0 OR http.content_length:>1000000)