CVE-2024-42943
📋 TL;DR
This vulnerability in Tenda FH1201 routers allows attackers to trigger a stack overflow by sending a specially crafted POST request to the PPPOEPassword parameter. This can cause a Denial of Service (DoS) by crashing the device. Users running Tenda FH1201 routers with vulnerable firmware are affected.
💻 Affected Systems
- Tenda FH1201
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device crash requiring physical reboot, potentially leading to extended network downtime and service disruption.
Likely Case
Router becomes unresponsive, requiring manual reboot to restore functionality, causing temporary network outage.
If Mitigated
If properly segmented and behind firewalls, impact limited to isolated network segment with quick recovery possible.
🎯 Exploit Status
Exploit requires sending a crafted POST request to the vulnerable endpoint. Public proof-of-concept available in GitHub repository.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates
2. Download latest firmware for FH1201
3. Access router web interface
4. Navigate to firmware upgrade section
5. Upload and apply new firmware
6. Reboot router after update completes
🔧 Temporary Workarounds
Disable Remote Management
allPrevent external access to router management interface
Network Segmentation
allIsolate router management interface to trusted network segment
🧯 If You Can't Patch
- Replace vulnerable router with updated model or different vendor
- Implement strict network access controls to limit access to router management interface
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via web interface at System Status or About pageCheck Version:
No CLI command - check via web interface at 192.168.0.1 or router IPVerify Fix Applied:
Verify firmware version is newer than v1.2.0.14 (408)📡 Detection & Monitoring
Log Indicators:
- Multiple POST requests to /goform/AdvSetWan with long PPPOEPassword parameter
- Router crash/reboot events in system logs
Network Indicators:
- Unusual POST requests to router management interface
- Sudden loss of connectivity to router
SIEM Query:
source="router_logs" AND (uri_path="/goform/AdvSetWan" AND method="POST" AND param_length>100)