CVE-2024-42951
📋 TL;DR
CVE-2024-42951 is a stack overflow vulnerability in Tenda FH1201 routers that allows attackers to cause Denial of Service (DoS) by sending specially crafted POST requests to the mit_pptpusrpw parameter. This affects Tenda FH1201 v1.2.0.14 (408) firmware users. The vulnerability requires network access to the router's web interface.
💻 Affected Systems
- Tenda FH1201
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete router crash requiring physical reboot, potential for remote code execution if combined with other vulnerabilities, and persistent DoS affecting all connected devices.
Likely Case
Router becomes unresponsive requiring reboot, temporary loss of internet connectivity for all connected devices, and potential configuration corruption.
If Mitigated
Minimal impact with proper network segmentation and access controls limiting exposure to the router's management interface.
🎯 Exploit Status
Exploitation requires sending crafted POST requests to the vulnerable endpoint. The GitHub reference contains technical details about the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check Tenda's official website for firmware updates. 2. Download the latest firmware for FH1201. 3. Access router web interface. 4. Navigate to System Tools > Firmware Upgrade. 5. Upload and install the new firmware. 6. Wait for router to reboot.
🔧 Temporary Workarounds
Disable Remote Management
allPrevent external access to router web interface
Change Default Credentials
allUse strong unique credentials for router admin access
🧯 If You Can't Patch
- Segment router management interface to internal network only
- Implement network firewall rules to restrict access to router management ports (typically 80/443)
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in web interface under System Status or System Tools > Firmware UpgradeCheck Version:
Not applicable - check via router web interfaceVerify Fix Applied:
Verify firmware version is newer than v1.2.0.14 (408) after update📡 Detection & Monitoring
Log Indicators:
- Multiple POST requests to /goform/fromWizardHandle with mit_pptpusrpw parameter
- Router reboot events without user action
- Unusual traffic to router management interface
Network Indicators:
- HTTP POST requests with unusually long mit_pptpusrpw parameter values
- Traffic to router port 80/443 from unexpected sources
SIEM Query:
source="router_logs" AND (uri_path="/goform/fromWizardHandle" OR event_description="reboot")