CVE-2024-2977
📋 TL;DR
A critical stack-based buffer overflow vulnerability in Tenda F1203 routers allows remote attackers to execute arbitrary code by manipulating the PPPOEPassword parameter. This affects Tenda F1203 firmware version 2.0.1.6. Attackers can exploit this without authentication to potentially take full control of affected devices.
💻 Affected Systems
- Tenda F1203
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, lateral movement to internal networks, persistent backdoor installation, and botnet recruitment.
Likely Case
Device takeover for credential theft, network traffic interception, or use as a pivot point for internal attacks.
If Mitigated
Limited to denial of service if exploit attempts are blocked at network perimeter.
🎯 Exploit Status
Public exploit code is available. The vulnerability requires no authentication and has straightforward exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: Yes
Instructions:
No official patch available. Contact Tenda support for firmware updates. Consider replacing affected devices if no patch is forthcoming.
🔧 Temporary Workarounds
Network Segmentation
allIsolate Tenda F1203 routers from internet and restrict access to management interfaces.
Access Control Lists
linuxBlock access to /goform/QuickIndex endpoint at network perimeter.
iptables -A INPUT -p tcp --dport 80 -m string --string "/goform/QuickIndex" --algo bm -j DROP
🧯 If You Can't Patch
- Replace affected Tenda F1203 routers with alternative models from different vendors
- Implement strict network segmentation to isolate vulnerable devices from critical assets
🔍 How to Verify
Check if Vulnerable:
Check router web interface for firmware version. If version is 2.0.1.6, device is vulnerable.Check Version:
Access router web interface at http://[router-ip]/ and check firmware version in system settingsVerify Fix Applied:
Verify firmware version has been updated to a version later than 2.0.1.6.📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /goform/QuickIndex with long PPPOEPassword parameters
- Unusual process execution or memory errors in router logs
Network Indicators:
- HTTP traffic to router IP on port 80 with POST to /goform/QuickIndex
- Unusual outbound connections from router
SIEM Query:
source="router_logs" AND (uri_path="/goform/QuickIndex" OR http_method="POST" AND uri_path CONTAINS "QuickIndex")🔗 References
- https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/F/F1203/formQuickIndex.md
- https://vuldb.com/?ctiid.258146
- https://vuldb.com/?id.258146
- https://vuldb.com/?submit.301028
- https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/F/F1203/formQuickIndex.md
- https://vuldb.com/?ctiid.258146
- https://vuldb.com/?id.258146
- https://vuldb.com/?submit.301028
