CVE-2024-2983
📋 TL;DR
This critical vulnerability in Tenda FH1202 routers allows remote attackers to execute arbitrary code via a stack-based buffer overflow in the formSetClientState function. Attackers can exploit this by manipulating deviceId/limitSpeed/limitSpeedUp parameters to gain control of affected devices. All users of Tenda FH1202 routers with vulnerable firmware are affected.
💻 Affected Systems
- Tenda FH1202
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, network infiltration, data theft, and persistent backdoor installation.
Likely Case
Router takeover enabling man-in-the-middle attacks, credential harvesting, and botnet recruitment.
If Mitigated
Limited impact if devices are behind firewalls with strict inbound filtering and network segmentation.
🎯 Exploit Status
Exploit details are publicly available on GitHub, making weaponization likely. No authentication is required for exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates 2. If update available, download and install via router admin interface 3. Reboot router after update 4. Verify firmware version is no longer 1.2.0.14(408)
🔧 Temporary Workarounds
Network Isolation
allPlace affected routers behind firewalls with strict inbound filtering
Access Restriction
linuxBlock external access to router admin interface (port 80/443)
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Replace affected routers with different models or brands
- Implement strict network segmentation to isolate vulnerable devices
🔍 How to Verify
Check if Vulnerable:
Access router admin interface and check firmware version under System Status or similar sectionCheck Version:
curl -s http://router-ip/goform/getStatus | grep versionVerify Fix Applied:
Verify firmware version is no longer 1.2.0.14(408) after update📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/SetClientState
- Multiple buffer overflow attempts in router logs
- Unexpected device reboots or crashes
Network Indicators:
- Unusual traffic patterns from router to external IPs
- POST requests with long deviceId/limitSpeed parameters
- Traffic to known exploit repositories
SIEM Query:
source="router_logs" AND (uri="/goform/SetClientState" AND (deviceId.length>100 OR limitSpeed.length>100))🔗 References
- https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1202/formSetClientState.md
- https://vuldb.com/?ctiid.258152
- https://vuldb.com/?id.258152
- https://vuldb.com/?submit.301274
- https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1202/formSetClientState.md
- https://vuldb.com/?ctiid.258152
- https://vuldb.com/?id.258152
- https://vuldb.com/?submit.301274
