CVE-2024-30591
📋 TL;DR
CVE-2024-30591 is a stack overflow vulnerability in Tenda FH1202 routers that allows remote code execution via the time parameter in the saveParentControlInfo function. Attackers can exploit this to take control of affected routers. Users of Tenda FH1202 routers with vulnerable firmware are affected.
💻 Affected Systems
- Tenda FH1202
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of router with persistent backdoor installation, credential theft, and pivot to internal network devices.
Likely Case
Router takeover leading to DNS hijacking, traffic interception, and denial of service.
If Mitigated
Limited impact if router is behind firewall with restricted WAN access and updated firmware.
🎯 Exploit Status
Exploit requires authentication to router web interface. Proof-of-concept code is publicly available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates. 2. Download latest firmware. 3. Log into router admin panel. 4. Navigate to System Tools > Firmware Upgrade. 5. Upload and install new firmware. 6. Reboot router.
🔧 Temporary Workarounds
Disable remote management
allPrevent WAN access to router web interface
Restrict LAN access
allUse firewall rules to limit which devices can access router admin interface
🧯 If You Can't Patch
- Isolate router on separate VLAN with strict access controls
- Implement network segmentation to limit router compromise impact
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in web interface under System Status > Firmware VersionCheck Version:
curl -s http://router-ip/goform/getStatus | grep versionVerify Fix Applied:
Verify firmware version is newer than v1.2.0.14(408)📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/saveParentControlInfo with long time parameter
- Multiple failed authentication attempts followed by successful login
Network Indicators:
- Unusual outbound connections from router
- DNS queries to suspicious domains
- Port scanning originating from router
SIEM Query:
source="router_logs" AND (uri_path="/goform/saveParentControlInfo" AND param_length>100) OR (event="authentication" AND result="success" AFTER result="failure")