CVE-2024-42949
📋 TL;DR
This vulnerability in Tenda FH1201 routers allows attackers to trigger a stack overflow via a crafted POST request to the qos parameter, leading to Denial of Service. It affects users running vulnerable firmware versions on these specific router models. The attack requires network access to the router's web interface.
💻 Affected Systems
- Tenda FH1201
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete router crash requiring physical power cycle, potentially leading to extended network downtime and disruption of all connected services.
Likely Case
Router becomes unresponsive, requiring reboot and causing temporary network outage for all connected devices.
If Mitigated
If router is behind firewall with restricted web interface access, impact is limited to internal network disruption only.
🎯 Exploit Status
Public GitHub repository contains detailed analysis and proof-of-concept. Exploit requires sending crafted POST request to vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not found
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates 2. Download latest firmware 3. Access router admin interface 4. Upload and apply firmware update 5. Reboot router
🔧 Temporary Workarounds
Disable QoS feature
allTurn off Quality of Service functionality in router settings to remove vulnerable code path
Restrict web interface access
linuxConfigure firewall to block external access to router admin interface (typically port 80/443)
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Isolate router on separate VLAN with restricted access
- Implement network monitoring for abnormal POST requests to /goform/qossetting
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface. If version is exactly v1.2.0.14 (408), device is vulnerable.Check Version:
curl -s http://router-ip/login/Auth | grep firmware version or check web interfaceVerify Fix Applied:
Verify firmware version has changed from v1.2.0.14 (408) to a newer version.📡 Detection & Monitoring
Log Indicators:
- Multiple POST requests to /goform/qossetting with large qos parameter
- Router crash/reboot logs
Network Indicators:
- Abnormal POST requests to router IP port 80 with oversized qos parameter
- Sudden loss of router connectivity
SIEM Query:
source="router_logs" AND uri="/goform/qossetting" AND method="POST" AND size_bytes>1000