CVE-2024-42955
📋 TL;DR
CVE-2024-42955 is a stack overflow vulnerability in Tenda FH1201 routers that allows attackers to cause Denial of Service (DoS) by sending specially crafted POST requests. This affects Tenda FH1201 router users running vulnerable firmware versions. The vulnerability exists in the fromSafeClientFilter function's handling of the page parameter.
💻 Affected Systems
- Tenda FH1201
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete router crash requiring physical reboot, potential remote code execution if stack overflow can be controlled precisely (though not confirmed in this CVE)
Likely Case
Router becomes unresponsive, requiring reboot to restore functionality, disrupting network connectivity
If Mitigated
Minimal impact with proper network segmentation and firewall rules blocking external access to router management interface
🎯 Exploit Status
Public proof-of-concept available on GitHub showing how to trigger the vulnerability via POST request
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates 2. Download latest firmware 3. Upload via router admin interface 4. Reboot router
🔧 Temporary Workarounds
Disable remote management
allPrevent external access to router management interface
Network segmentation
allIsolate router management interface to trusted network segment only
🧯 If You Can't Patch
- Replace vulnerable router with different model/brand
- Implement strict firewall rules blocking all external access to router management interface (ports 80/443)
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface under System Status or Firmware Upgrade sectionCheck Version:
Login to router admin interface and navigate to System Status pageVerify Fix Applied:
Verify firmware version has been updated to a version newer than v1.2.0.14 (408)📡 Detection & Monitoring
Log Indicators:
- Multiple POST requests to router management interface with malformed page parameter
- Router crash/reboot logs
Network Indicators:
- Unusual POST requests to router management interface from external IPs
- Sudden loss of router connectivity
SIEM Query:
source="router_logs" AND (http_method="POST" AND uri CONTAINS "fromSafeClientFilter" OR message CONTAINS "crash" OR message CONTAINS "reboot")