CVE-2024-2992
📋 TL;DR
This critical vulnerability in Tenda FH1203 routers allows remote attackers to execute arbitrary code via a stack-based buffer overflow in the formSetCfm function. Attackers can exploit this by sending specially crafted requests to the /goform/setcfm endpoint. All users running affected firmware versions are at risk of complete device compromise.
💻 Affected Systems
- Tenda FH1203
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to full device takeover, persistent backdoor installation, network traffic interception, and lateral movement to other devices on the network.
Likely Case
Remote code execution allowing attackers to modify router settings, intercept traffic, or use the device as part of a botnet.
If Mitigated
If properly segmented and firewalled, impact limited to the router itself without network-wide compromise.
🎯 Exploit Status
Exploit details are publicly available on GitHub, making weaponization straightforward. The vulnerability requires no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: Yes
Instructions:
No official patch is available. Contact Tenda support for firmware updates or consider replacing affected devices.
🔧 Temporary Workarounds
Network Segmentation
allIsolate Tenda FH1203 routers from critical network segments and the internet
Access Control Lists
linuxBlock access to /goform/setcfm endpoint at network perimeter
iptables -A INPUT -p tcp --dport 80 -m string --string "/goform/setcfm" --algo bm -j DROP
🧯 If You Can't Patch
- Immediately disconnect affected routers from the internet
- Replace vulnerable Tenda FH1203 routers with patched or alternative devices
🔍 How to Verify
Check if Vulnerable:
Check router web interface or CLI for firmware version. If version is 2.0.1.6, device is vulnerable.Check Version:
Check router web interface at http://[router-ip]/ or use telnet/ssh if enabledVerify Fix Applied:
Verify firmware version has been updated to a version later than 2.0.1.6 (when available).📡 Detection & Monitoring
Log Indicators:
- Multiple POST requests to /goform/setcfm with large funcpara1 parameters
- Unusual process execution or configuration changes
Network Indicators:
- HTTP POST requests to /goform/setcfm with oversized payloads
- Unusual outbound connections from router
SIEM Query:
source="router_logs" AND (url="/goform/setcfm" AND content_length>1000)🔗 References
- https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1203/formSetCfm.md
- https://vuldb.com/?ctiid.258161
- https://vuldb.com/?id.258161
- https://vuldb.com/?submit.301371
- https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1203/formSetCfm.md
- https://vuldb.com/?ctiid.258161
- https://vuldb.com/?id.258161
- https://vuldb.com/?submit.301371
