CVE-2024-42945
📋 TL;DR
Tenda FH1201 routers running firmware v1.2.0.14 (408) contain a stack overflow vulnerability in the fromAddressNat function's page parameter. Attackers can exploit this via crafted POST requests to cause Denial of Service (DoS), potentially crashing the device. This affects users of Tenda FH1201 routers with the vulnerable firmware version.
💻 Affected Systems
- Tenda FH1201
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device crash requiring physical reboot, potential remote code execution if combined with other vulnerabilities, and persistent network disruption.
Likely Case
Router becomes unresponsive, requiring reboot to restore functionality, causing temporary network outage for connected devices.
If Mitigated
Limited impact if device is behind firewall with restricted WAN access, though LAN exploitation remains possible.
🎯 Exploit Status
Public GitHub repository contains proof-of-concept. Exploitation requires sending crafted POST request to vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
1. Check Tenda website for firmware updates. 2. If update available, download and install via web interface. 3. Monitor vendor communications for security patches.
🔧 Temporary Workarounds
Disable Remote Management
allPrevent external access to router web interface
Network Segmentation
allIsolate router management interface from untrusted networks
🧯 If You Can't Patch
- Replace device with supported model
- Implement strict network access controls to limit exposure
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router web interface under System Status or similar sectionCheck Version:
Login to router web interface and navigate to System Status pageVerify Fix Applied:
Verify firmware version is newer than v1.2.0.14 (408)📡 Detection & Monitoring
Log Indicators:
- Multiple POST requests to fromAddressNat endpoint
- Router crash/reboot events
- Unusual traffic patterns to router management interface
Network Indicators:
- Crafted POST requests with malformed page parameter
- Traffic to router web management port (typically 80/443)
SIEM Query:
source_ip="router_ip" AND (http_method="POST" AND uri CONTAINS "fromAddressNat")