CVE-2024-30587
📋 TL;DR
CVE-2024-30587 is a critical stack overflow vulnerability in Tenda FH1202 routers that allows remote code execution. Attackers can exploit the 'urls' parameter in the saveParentControlInfo function to crash the device or execute arbitrary code. This affects all users running the vulnerable firmware version.
💻 Affected Systems
- Tenda FH1202
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing persistent backdoor installation, network traffic interception, and lateral movement to other devices on the network.
Likely Case
Remote code execution leading to device takeover, enabling attackers to modify router settings, intercept traffic, or use the device as a botnet node.
If Mitigated
Denial of service through device crash if exploit fails to achieve code execution, requiring physical reset.
🎯 Exploit Status
Public proof-of-concept code is available in GitHub repositories. The vulnerability requires no authentication and has straightforward exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check Tenda's official website for firmware updates. 2. If update available, download and install via web interface. 3. Reboot router after installation. 4. Verify firmware version is no longer v1.2.0.14(408).
🔧 Temporary Workarounds
Disable web management interface
allPrevent access to the vulnerable function by disabling the router's web interface
Access router settings via SSH/Telnet if available and disable web interface
Network segmentation
allIsolate vulnerable routers from critical network segments
Configure firewall rules to restrict access to router management interface
🧯 If You Can't Patch
- Replace vulnerable devices with patched or different model routers
- Implement strict network access controls to limit exposure of router management interface
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via web interface at 192.168.0.1 or 192.168.1.1, login and navigate to System StatusCheck Version:
curl -s http://router-ip/goform/getStatus | grep versionVerify Fix Applied:
Verify firmware version is no longer v1.2.0.14(408) and test if saveParentControlInfo function still accepts malformed urls parameter📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/saveParentControlInfo with long urls parameter
- Router crash/reboot logs
- Multiple failed login attempts followed by exploitation attempts
Network Indicators:
- HTTP requests with unusually long parameters to router management interface
- Traffic patterns suggesting router compromise (unexpected outbound connections)
SIEM Query:
source="router_logs" AND (uri_path="/goform/saveParentControlInfo" AND parameter_length>1000) OR (event_type="crash" AND device_model="FH1202")