CVE-2024-2985
📋 TL;DR
A critical stack-based buffer overflow vulnerability in Tenda FH1202 routers allows remote attackers to execute arbitrary code by manipulating the PPPOEPassword parameter. This affects Tenda FH1202 firmware version 1.2.0.14(408) and potentially other versions. Attackers can exploit this without authentication to potentially take full control of affected devices.
💻 Affected Systems
- Tenda FH1202
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, creation of persistent backdoors, lateral movement to internal networks, and botnet recruitment.
Likely Case
Remote code execution allowing attackers to modify device configuration, intercept network traffic, or use the device as a pivot point for further attacks.
If Mitigated
Denial of service if exploit fails or is detected, or limited impact if device is isolated with proper network segmentation.
🎯 Exploit Status
Exploit details are publicly available on GitHub. The vulnerability requires sending a specially crafted HTTP request to the /goform/QuickIndex endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available - vendor did not respond to disclosure
Restart Required: Yes
Instructions:
No official patch available. Monitor Tenda website for firmware updates. If update becomes available: 1. Download firmware from official Tenda site 2. Access router admin interface 3. Navigate to firmware upgrade section 4. Upload and apply new firmware 5. Reboot router
🔧 Temporary Workarounds
Disable WAN access to management interface
allPrevent external access to the vulnerable web interface
Access router admin panel -> Security/Firewall settings -> Disable remote management/remote access
Change default credentials
allMitigate risk if authentication is required (though exploit is unauthenticated)
Access router admin panel -> System/Administration -> Change admin password
🧯 If You Can't Patch
- Isolate affected devices in a separate VLAN with strict firewall rules
- Implement network-based intrusion prevention (IPS) to block exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface. If version is 1.2.0.14(408), device is vulnerable. Also check if /goform/QuickIndex endpoint is accessible.Check Version:
curl -s http://router-ip/ | grep -i firmware || Access router web interface and check System/Status pageVerify Fix Applied:
Verify firmware version has changed from 1.2.0.14(408). Test if buffer overflow payloads to PPPOEPassword parameter no longer cause crashes.📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /goform/QuickIndex with long PPPOEPassword parameters
- Router crash/reboot logs
- Unusual process creation in router logs
Network Indicators:
- HTTP POST requests to router IP on port 80/443 with oversized PPPOEPassword parameter
- Unusual outbound connections from router after exploitation
SIEM Query:
source="router_logs" AND (uri_path="/goform/QuickIndex" AND content_length>1000) OR (event_type="crash" AND device_model="FH1202")🔗 References
- https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1202/formQuickIndex.md
- https://vuldb.com/?ctiid.258154
- https://vuldb.com/?id.258154
- https://vuldb.com/?submit.301276
- https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1202/formQuickIndex.md
- https://vuldb.com/?ctiid.258154
- https://vuldb.com/?id.258154
- https://vuldb.com/?submit.301276
