CVE-2024-2990
📋 TL;DR
This critical vulnerability in Tenda FH1203 routers allows remote attackers to execute arbitrary code via a stack-based buffer overflow in the formexeCommand function. Attackers can exploit this without authentication to potentially take full control of affected devices. All users running vulnerable firmware versions are affected.
💻 Affected Systems
- Tenda FH1203
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise leading to persistent backdoor installation, network traffic interception, lateral movement to other devices, and botnet recruitment.
Likely Case
Remote code execution allowing attackers to modify router settings, intercept traffic, or use the device as a pivot point for further attacks.
If Mitigated
Limited impact if device is behind firewall with strict inbound rules, though internal network exposure remains a concern.
🎯 Exploit Status
Public GitHub repository contains detailed exploitation information. The vulnerability requires sending crafted HTTP requests to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available - vendor did not respond to disclosure
Restart Required: Yes
Instructions:
No official patch available. Consider replacing affected devices with supported models from vendors that provide security updates.
🔧 Temporary Workarounds
Network Segmentation
allIsolate Tenda FH1203 routers in separate VLAN with strict firewall rules blocking access to management interfaces.
Access Control Lists
allImplement network ACLs to restrict access to router management interface (port 80/443) to trusted IP addresses only.
🧯 If You Can't Patch
- Replace affected Tenda FH1203 routers with devices from vendors that provide security updates
- Deploy network monitoring to detect exploitation attempts and isolate compromised devices immediately
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via web interface at 192.168.0.1 or 192.168.1.1. If version is 2.0.1.6 or earlier, device is likely vulnerable.Check Version:
curl -s http://router-ip/goform/getStatus | grep version or check web interfaceVerify Fix Applied:
No fix available to verify. Consider testing with network vulnerability scanner for CVE-2024-2990 detection.📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /goform/execCommand with unusual cmdinput parameter values
- Router crash/restart logs
- Unusual process execution in router logs
Network Indicators:
- HTTP traffic to router IP on port 80/443 with POST to /goform/execCommand containing long cmdinput parameters
- Sudden outbound connections from router to suspicious IPs
SIEM Query:
source="router_logs" AND (url="/goform/execCommand" OR cmdinput="*")🔗 References
- https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1203/formexeCommand.md
- https://vuldb.com/?ctiid.258159
- https://vuldb.com/?id.258159
- https://vuldb.com/?submit.301365
- https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1203/formexeCommand.md
- https://vuldb.com/?ctiid.258159
- https://vuldb.com/?id.258159
- https://vuldb.com/?submit.301365
