CVE-2024-2979
📋 TL;DR
A critical stack-based buffer overflow vulnerability in Tenda F1203 routers allows remote attackers to execute arbitrary code by manipulating time parameters in the WiFi scheduling function. This affects Tenda F1203 routers running firmware version 2.0.1.6. Attackers can exploit this without authentication to potentially take full control of affected devices.
💻 Affected Systems
- Tenda F1203
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, persistence installation, network pivoting, and data exfiltration.
Likely Case
Device crash/reboot (DoS) or limited code execution to modify router settings, intercept traffic, or join botnets.
If Mitigated
Attack fails due to network segmentation, exploit mitigation controls, or patched firmware.
🎯 Exploit Status
Public exploit details available on GitHub. The vulnerability requires no authentication and has straightforward exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates. 2. If update available, download and install via router web interface. 3. Reboot router after update. Note: Vendor has not responded to disclosure.
🔧 Temporary Workarounds
Disable Remote Management
allPrevent external access to router administration interface
Network Segmentation
allIsolate router management interface to trusted network segment only
🧯 If You Can't Patch
- Replace affected devices with different models/vendors
- Implement strict network access controls to limit exposure to router management interface
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via web interface (typically under System Status or About page). If version is 2.0.1.6, device is vulnerable.Check Version:
curl -s http://router-ip/goform/getStatus | grep version (or check web interface)Verify Fix Applied:
Verify firmware version has changed from 2.0.1.6 to a newer version. Test if /goform/openSchedWifi endpoint still accepts malformed time parameters.📡 Detection & Monitoring
Log Indicators:
- Multiple failed requests to /goform/openSchedWifi
- Unusual POST requests with long time parameters
- Router crash/reboot logs
Network Indicators:
- HTTP POST requests to /goform/openSchedWifi with unusually long schedStartTime/schedEndTime parameters
- Traffic patterns suggesting exploit attempts
SIEM Query:
source="router_logs" AND (uri_path="/goform/openSchedWifi" AND (param_length>100 OR status_code=500))🔗 References
- https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/F/F1203/setSchedWifi_end.md
- https://vuldb.com/?ctiid.258148
- https://vuldb.com/?id.258148
- https://vuldb.com/?submit.301030
- https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/F/F1203/setSchedWifi_end.md
- https://vuldb.com/?ctiid.258148
- https://vuldb.com/?id.258148
- https://vuldb.com/?submit.301030
