CVE-2024-30595
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on Tenda FH1202 routers by exploiting a stack overflow in the addWifiMacFilter function. Attackers can gain full control of affected devices, potentially compromising network security. All users of Tenda FH1202 routers with firmware version 1.2.0.14(408) are affected.
💻 Affected Systems
- Tenda FH1202
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device takeover leading to persistent backdoor installation, network traffic interception, credential theft, and lateral movement to other devices on the network.
Likely Case
Remote code execution allowing attackers to modify router settings, intercept traffic, or use the device as part of a botnet.
If Mitigated
Limited impact if device is behind firewall with restricted WAN access and proper network segmentation.
🎯 Exploit Status
Public proof-of-concept available in GitHub repository. Exploitation requires sending specially crafted requests to the web interface.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
1. Check Tenda official website for firmware updates
2. If update available, download and install via web interface
3. Monitor vendor communications for security patches
🔧 Temporary Workarounds
Disable Remote Management
allPrevent external access to router web interface
Network Segmentation
allIsolate router management interface from untrusted networks
🧯 If You Can't Patch
- Replace affected device with patched or alternative model
- Implement strict firewall rules to block all inbound traffic to router management interface
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router web interface under System Status or About pageCheck Version:
curl -s http://router-ip/goform/getStatus | grep versionVerify Fix Applied:
Verify firmware version is newer than v1.2.0.14(408)📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/addWifiMacFilter
- Multiple failed authentication attempts
- Unexpected configuration changes
Network Indicators:
- Unusual outbound connections from router
- Traffic patterns suggesting command and control communication
- Port scanning originating from router
SIEM Query:
source="router_logs" AND (uri="/goform/addWifiMacFilter" OR deviceId="*overflow*")