CVE-2024-3008
📋 TL;DR
This critical vulnerability in Tenda FH1205 routers allows remote attackers to execute arbitrary code via a stack-based buffer overflow in the formexeCommand function. Attackers can exploit this without authentication to potentially take full control of affected devices. All users of Tenda FH1205 routers with version 2.0.0.7(775) are affected.
💻 Affected Systems
- Tenda FH1205
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise leading to persistent backdoor installation, network traffic interception, lateral movement to other devices, and botnet recruitment.
Likely Case
Remote code execution allowing attackers to modify router settings, intercept traffic, or use the device as a pivot point for further attacks.
If Mitigated
If properly segmented and firewalled, impact limited to the router itself without lateral movement to other network segments.
🎯 Exploit Status
Public exploit code is available on GitHub. The vulnerability requires no authentication and has straightforward exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available - vendor did not respond to disclosure
Restart Required: Yes
Instructions:
No official patch available. Consider replacing affected devices or implementing workarounds.
🔧 Temporary Workarounds
Block Web Interface Access
allRestrict access to the router's web management interface to trusted IP addresses only
Configure firewall rules to block external access to port 80/443 on the router
Use router's built-in access control to restrict management IPs
Disable Remote Management
allTurn off remote management features if enabled
Login to router admin panel
Navigate to System Tools > Remote Management
Disable remote management
🧯 If You Can't Patch
- Segment affected routers on isolated network segments
- Implement strict egress filtering to prevent compromised devices from contacting command and control servers
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via web interface at 192.168.0.1 or 192.168.1.1, login and check System Status > Firmware VersionCheck Version:
curl -s http://router-ip/goform/getStatus | grep version or check web interface manuallyVerify Fix Applied:
No official fix available to verify. Workarounds can be verified by testing if web interface is inaccessible from untrusted networks.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/execCommand
- Multiple failed buffer overflow attempts in web server logs
- Unexpected process crashes or router reboots
Network Indicators:
- Unusual outbound connections from router to unknown IPs
- Traffic patterns suggesting command and control communication
- Port scanning originating from router
SIEM Query:
source="router_logs" AND (url="/goform/execCommand" OR cmdinput=*)🔗 References
- https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1205/formexeCommand.md
- https://vuldb.com/?ctiid.258294
- https://vuldb.com/?id.258294
- https://vuldb.com/?submit.301487
- https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1205/formexeCommand.md
- https://vuldb.com/?ctiid.258294
- https://vuldb.com/?id.258294
- https://vuldb.com/?submit.301487
