CVE-2024-42947
📋 TL;DR
This vulnerability allows attackers to execute arbitrary commands on Tenda FH1201 routers by sending a specially crafted HTTP request to the /goform/telnet endpoint. Attackers can gain full control of affected devices, potentially compromising network security. Users of Tenda FH1201 routers with vulnerable firmware are affected.
💻 Affected Systems
- Tenda FH1201
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device takeover allowing attackers to install malware, intercept network traffic, pivot to internal networks, or create persistent backdoors.
Likely Case
Attackers gain remote shell access to execute commands, potentially stealing credentials, modifying router settings, or launching attacks against internal devices.
If Mitigated
With proper network segmentation and access controls, impact is limited to the router itself rather than entire network.
🎯 Exploit Status
Public GitHub repository contains exploit details and proof-of-concept. Simple HTTP request triggers the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: No
Instructions:
Check Tenda official website for firmware updates. If available, download latest firmware and apply through router admin interface.
🔧 Temporary Workarounds
Disable remote management
allDisable remote administration/management features to prevent external exploitation
Network segmentation
allIsolate router management interface to separate VLAN or restrict access to trusted IPs only
🧯 If You Can't Patch
- Replace affected routers with different models or brands
- Implement strict firewall rules blocking all external access to router management interfaces
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface. If version is v1.2.0.14 (408), device is vulnerable.Check Version:
Check router web interface at 192.168.0.1 or 192.168.1.1, navigate to System Status or About pageVerify Fix Applied:
After updating firmware, verify version has changed from v1.2.0.14 (408) to a newer version.📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /goform/telnet endpoint
- Unusual command execution in router logs
- Failed authentication attempts followed by successful access
Network Indicators:
- HTTP POST requests to router IP on port 80 targeting /goform/telnet
- Unexpected outbound connections from router
SIEM Query:
source="router_logs" AND (uri="/goform/telnet" OR command="telnet")