CVE-2024-42941
📋 TL;DR
This vulnerability in Tenda FH1201 routers allows attackers to trigger a stack overflow via a crafted POST request to the wanmode parameter. Exploitation can cause Denial of Service (DoS) by crashing the device. Only Tenda FH1201 routers running specific vulnerable firmware are affected.
💻 Affected Systems
- Tenda FH1201
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device crash requiring physical power cycle, potentially leading to persistent DoS if attacks are repeated.
Likely Case
Temporary service disruption requiring router reboot, affecting all connected devices.
If Mitigated
Minimal impact if device is behind firewall with restricted web interface access.
🎯 Exploit Status
Public GitHub repository contains detailed exploitation information including proof-of-concept.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
Check Tenda official website for firmware updates. If available, download and flash via web interface.
🔧 Temporary Workarounds
Restrict Web Interface Access
linuxBlock external access to router web interface using firewall rules.
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Isolate vulnerable routers in separate network segments
- Implement network monitoring for suspicious POST requests to router IP
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in web interface under System Status or similar section.Check Version:
curl -s http://router-ip/status.cgi | grep versionVerify Fix Applied:
Verify firmware version has changed from v1.2.0.14 (408) to a newer version.📡 Detection & Monitoring
Log Indicators:
- Multiple POST requests to /goform/AdvSetWan with large wanmode parameter
- Router crash/reboot logs
Network Indicators:
- Unusual POST traffic to router port 80/443 from external IPs
- HTTP requests with oversized parameters
SIEM Query:
source="router.log" AND "POST /goform/AdvSetWan" AND "wanmode="