CVE-2024-30604
📋 TL;DR
Tenda FH1203 router firmware version 2.0.1.6 contains a stack overflow vulnerability in the fromDhcpListClient function's list1 parameter. This allows attackers to execute arbitrary code or cause denial of service by sending specially crafted requests. Users with Tenda FH1203 routers running the vulnerable firmware are affected.
💻 Affected Systems
- Tenda FH1203
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, persistent backdoor installation, and lateral movement to connected networks.
Likely Case
Denial of service causing router crashes and network disruption, potentially requiring physical reset.
If Mitigated
Limited impact with proper network segmentation and firewall rules blocking external access to management interfaces.
🎯 Exploit Status
Public proof-of-concept exists in GitHub repositories; exploitation requires sending crafted HTTP requests to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check Tenda's official website for firmware updates. 2. Download the latest firmware for FH1203. 3. Access router admin panel. 4. Navigate to firmware upgrade section. 5. Upload and apply the new firmware. 6. Reboot the router.
🔧 Temporary Workarounds
Disable remote management
allPrevent external access to router management interface
Network segmentation
allIsolate router management interface to trusted network segments only
🧯 If You Can't Patch
- Replace affected router with a different model or vendor
- Implement strict firewall rules blocking all external access to router management ports (typically 80/443)
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin panel; if version is exactly 2.0.1.6, device is vulnerable.Check Version:
Connect to router admin interface (typically http://192.168.0.1) and check System Status or Firmware Version page.Verify Fix Applied:
After firmware update, verify version number has changed from 2.0.1.6 in router admin interface.📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP requests to /goform/DhcpListClient endpoint
- Router crash/reboot events in system logs
- Multiple failed authentication attempts followed by exploitation attempts
Network Indicators:
- Unusual traffic patterns to router management interface from external IPs
- HTTP POST requests with abnormally long list1 parameter values
SIEM Query:
source="router_logs" AND (uri_path="/goform/DhcpListClient" OR event_description="system reboot" OR event_description="crash")