CVE-2024-2987
📋 TL;DR
A critical stack-based buffer overflow vulnerability in Tenda FH1202 routers allows remote attackers to execute arbitrary code by manipulating the 'mac' parameter in the GetParentControlInfo function. This affects Tenda FH1202 routers running firmware version 1.2.0.14(408). Attackers can exploit this without authentication to potentially take full control of affected devices.
💻 Affected Systems
- Tenda FH1202
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, allowing attackers to install persistent malware, pivot to internal networks, or join botnets.
Likely Case
Device takeover enabling network traffic interception, DNS hijacking, credential theft, and lateral movement within the network.
If Mitigated
Denial of service or device crash if exploit fails, but proper controls should prevent exploitation entirely.
🎯 Exploit Status
Public exploit code is available on GitHub. The vulnerability requires no authentication and has straightforward exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available - vendor did not respond to disclosure
Restart Required: No
Instructions:
No official patch available. Check Tenda website for firmware updates, but vendor has been unresponsive.
🔧 Temporary Workarounds
Disable remote management
allPrevent external access to the router's web management interface
Access router admin panel → Advanced Settings → Remote Management → Disable
Block vulnerable endpoint
linuxUse firewall rules to block access to the vulnerable /goform/GetParentControlInfo endpoint
iptables -A INPUT -p tcp --dport 80 -m string --string "/goform/GetParentControlInfo" --algo bm -j DROP
🧯 If You Can't Patch
- Replace affected routers with different models or brands that receive security updates
- Segment affected routers in isolated network zones with strict firewall rules
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin panel: System Status → Firmware Version. If version is 1.2.0.14(408), device is vulnerable.Check Version:
curl -s http://router-ip/goform/getStatus | grep versionVerify Fix Applied:
Verify firmware version has changed from 1.2.0.14(408) to a newer version, though no official patch exists.📡 Detection & Monitoring
Log Indicators:
- Multiple POST requests to /goform/GetParentControlInfo with long mac parameters
- Router crash/reboot logs
- Unusual outbound connections from router
Network Indicators:
- HTTP requests with oversized mac parameters (> typical MAC address length)
- Traffic patterns suggesting router compromise
SIEM Query:
source="router_logs" AND uri="/goform/GetParentControlInfo" AND (param_length(mac) > 20 OR status=500)🔗 References
- https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1202/GetParentControlInfo.md
- https://vuldb.com/?ctiid.258156
- https://vuldb.com/?id.258156
- https://vuldb.com/?submit.301285
- https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1202/GetParentControlInfo.md
- https://vuldb.com/?ctiid.258156
- https://vuldb.com/?id.258156
- https://vuldb.com/?submit.301285
