CVE-2024-42953
📋 TL;DR
Tenda FH1201 routers running firmware v1.2.0.14 (408) contain a stack overflow vulnerability in the fromWizardHandle function's PPW parameter. Attackers can exploit this via crafted POST requests to cause Denial of Service (DoS), potentially crashing the device. This affects users who haven't updated their Tenda FH1201 routers.
💻 Affected Systems
- Tenda FH1201
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device crash requiring physical reboot, potential remote code execution if stack overflow can be controlled to execute arbitrary code
Likely Case
Router becomes unresponsive, requiring reboot to restore functionality
If Mitigated
No impact if device is patched or network controls prevent exploitation
🎯 Exploit Status
Public GitHub repository contains proof-of-concept; exploitation requires sending crafted POST request to vulnerable endpoint
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates 2. Download latest firmware 3. Access router admin interface 4. Upload and apply firmware update 5. Reboot router
🔧 Temporary Workarounds
Network Segmentation
allIsolate vulnerable routers from untrusted networks
Access Control
linuxRestrict access to router admin interface
iptables -A INPUT -p tcp --dport 80 -s trusted_ip -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
🧯 If You Can't Patch
- Replace vulnerable device with updated model
- Deploy behind firewall with strict ingress filtering
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface; if version is v1.2.0.14 (408), device is vulnerableCheck Version:
curl -s http://router-ip/login/Auth | grep version or check admin interfaceVerify Fix Applied:
Verify firmware version has changed from v1.2.0.14 (408) to newer version📡 Detection & Monitoring
Log Indicators:
- Multiple POST requests to /goform/fromWizardHandle with long PPW parameter
- Router crash/reboot logs
Network Indicators:
- POST requests with unusually long PPW parameter values to router port 80
SIEM Query:
source="router_logs" AND (uri_path="/goform/fromWizardHandle" AND ppw_length>100)