CVE-2024-30599
📋 TL;DR
CVE-2024-30599 is a stack overflow vulnerability in Tenda FH1203 routers that allows remote code execution by sending specially crafted requests to the addWifiMacFilter function. Attackers can exploit this to take control of affected routers. This affects Tenda FH1203 v2.0.1.6 users who have the vulnerable firmware.
💻 Affected Systems
- Tenda FH1203
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attacker to install persistent malware, intercept all network traffic, pivot to internal networks, and use device as part of botnet.
Likely Case
Remote code execution leading to device takeover, network traffic interception, and potential credential theft from connected devices.
If Mitigated
Limited impact if device is behind firewall with restricted WAN access and proper network segmentation.
🎯 Exploit Status
Public proof-of-concept available on GitHub. Exploitation requires sending crafted HTTP request to vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates
2. Download latest firmware for FH1203
3. Access router web interface
4. Navigate to System Tools > Firmware Upgrade
5. Upload and install new firmware
6. Reboot router
🔧 Temporary Workarounds
Disable Remote Management
allDisable web interface access from WAN/Internet
Access router web interface > Advanced > System Tools > Remote Management > Disable
Restrict Management Access
allLimit management interface access to specific IPs
Access router web interface > Advanced > Security > Access Control > Add allowed IPs
🧯 If You Can't Patch
- Replace vulnerable device with different model/brand
- Place router behind firewall that blocks all inbound traffic to management interface
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router web interface: System Status > Firmware VersionCheck Version:
curl -s http://router-ip/goform/getStatus | grep versionVerify Fix Applied:
Verify firmware version is no longer v2.0.1.6 after update📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP POST requests to /goform/addWifiMacFilter
- Large deviceMac parameter values in logs
- Multiple failed authentication attempts followed by successful exploit
Network Indicators:
- HTTP traffic to router IP on port 80/443 with unusually long deviceMac parameter
- Outbound connections from router to suspicious IPs post-exploitation
SIEM Query:
source="router_logs" AND (uri="/goform/addWifiMacFilter" AND deviceMac.length>100) OR (process="malicious_binary" AND host="router_ip")