CVE-2024-3010
📋 TL;DR
This critical vulnerability in Tenda FH1205 routers allows remote attackers to execute arbitrary code via a stack-based buffer overflow in the formSetCfm function. Attackers can exploit this without authentication to potentially take full control of affected devices. Only Tenda FH1205 routers running firmware version 2.0.0.7(775) are affected.
💻 Affected Systems
- Tenda FH1205
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, persistent backdoor installation, network traffic interception, and lateral movement to other devices on the network.
Likely Case
Remote code execution allowing attackers to modify router settings, intercept traffic, or use the device as part of a botnet.
If Mitigated
Limited impact if devices are behind firewalls with strict inbound filtering, though internal network compromise remains possible.
🎯 Exploit Status
Exploit code is publicly available on GitHub. The vulnerability requires network access to the router's web interface but no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: Yes
Instructions:
No official patch is available. Contact Tenda support for firmware updates. Consider replacing affected devices if no patch becomes available.
🔧 Temporary Workarounds
Disable remote management
allDisable WAN-side access to the router's web management interface
Network segmentation
allIsolate affected routers on separate VLANs with strict firewall rules
🧯 If You Can't Patch
- Replace affected Tenda FH1205 routers with different models from vendors that provide security updates
- Implement strict network access controls to limit traffic to router management interfaces
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via web interface at http://[router-ip]/goform/getStatus or via command: curl http://[router-ip]/goform/getStatus | grep versionCheck Version:
curl -s http://[router-ip]/goform/getStatus | grep -o '"version":"[^"]*"'Verify Fix Applied:
Verify firmware version has changed from 2.0.0.7(775) to a newer version📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/setcfm with long funcpara1 parameters
- Multiple failed authentication attempts followed by successful exploitation
Network Indicators:
- Unusual outbound connections from router to unknown IPs
- Traffic patterns suggesting router compromise (C2 communications)
SIEM Query:
source="router_logs" AND (url="/goform/setcfm" AND method="POST" AND size>1000) OR (event="buffer_overflow" AND device="Tenda_FH1205")🔗 References
- https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1205/formSetCfm.md
- https://vuldb.com/?ctiid.258296
- https://vuldb.com/?id.258296
- https://vuldb.com/?submit.301489
- https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1205/formSetCfm.md
- https://vuldb.com/?ctiid.258296
- https://vuldb.com/?id.258296
- https://vuldb.com/?submit.301489
