CVE-2024-30630
📋 TL;DR
CVE-2024-30630 is a critical stack overflow vulnerability in Tenda FH1205 routers that allows remote attackers to execute arbitrary code by sending specially crafted requests to the saveParentControlInfo function. This affects all users running Tenda FH1205 v2.0.0.7(775) firmware who have the web interface accessible.
💻 Affected Systems
- Tenda FH1205
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise leading to persistent backdoor installation, network traffic interception, lateral movement to connected devices, and botnet recruitment.
Likely Case
Remote code execution allowing attacker to modify router settings, intercept traffic, or use the device as a pivot point for further attacks.
If Mitigated
Limited impact if device is behind firewall with no external access to web interface, though internal threats remain.
🎯 Exploit Status
Public proof-of-concept exists in GitHub repository. Exploitation requires sending malformed time parameter to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates. 2. Download latest firmware for FH1205. 3. Log into router web interface. 4. Navigate to System Tools > Firmware Upgrade. 5. Upload new firmware file. 6. Wait for reboot.
🔧 Temporary Workarounds
Disable Remote Management
allPrevent external access to router web interface
Change Default Admin Credentials
allMitigate unauthorized access attempts
🧯 If You Can't Patch
- Isolate router on separate VLAN with strict firewall rules
- Implement network monitoring for suspicious traffic to/from router
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in web interface under System Status or System Tools > Firmware Upgrade pageCheck Version:
curl -s http://router-ip/goform/getStatus | grep versionVerify Fix Applied:
Verify firmware version is no longer v2.0.0.7(775) after update📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/saveParentControlInfo
- Multiple failed login attempts followed by successful access
Network Indicators:
- Unusual outbound connections from router
- Traffic to known malicious IPs from router
SIEM Query:
source="router.log" AND (uri="/goform/saveParentControlInfo" OR "time parameter overflow")