CVE-2024-42984
📋 TL;DR
Tenda FH1206 routers running firmware v02.03.01.35 contain a stack overflow vulnerability in the fromP2pListFilter function via the page parameter. Attackers can exploit this by sending a crafted POST request to cause a Denial of Service (DoS), potentially crashing the device. This affects all users of this specific router model and firmware version.
💻 Affected Systems
- Tenda FH1206
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device crash requiring physical reboot, potential remote code execution if stack overflow can be controlled to execute arbitrary code (though not confirmed in this CVE).
Likely Case
Denial of Service causing router reboot and network disruption for connected devices.
If Mitigated
Limited impact if device is behind firewall with restricted web interface access.
🎯 Exploit Status
Public GitHub repository contains proof-of-concept. Exploitation requires sending a crafted POST request to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check Tenda website for firmware updates. 2. If update available, download and install via web interface. 3. Reboot router after update.
🔧 Temporary Workarounds
Disable remote web interface access
allPrevent external access to router administration interface
Access router settings > Administration > Remote Management > Disable
Restrict web interface to local network only
linuxConfigure firewall to block external access to router web ports (typically 80/443)
iptables -A INPUT -p tcp --dport 80 -s ! 192.168.1.0/24 -j DROP
iptables -A INPUT -p tcp --dport 443 -s ! 192.168.1.0/24 -j DROP
🧯 If You Can't Patch
- Isolate vulnerable router in separate network segment
- Implement network monitoring for suspicious POST requests to router IP
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in web interface under System Status or About pageCheck Version:
curl -s http://router-ip/ | grep -i firmware || wget -qO- http://router-ip/Verify Fix Applied:
Verify firmware version is no longer v02.03.01.35📡 Detection & Monitoring
Log Indicators:
- Multiple POST requests to /goform/P2pListFilter
- Router reboot logs
- Web interface crash events
Network Indicators:
- Unusual POST requests with long page parameter values to router IP
- Sudden loss of connectivity to router
SIEM Query:
source="router.log" AND ("POST /goform/P2pListFilter" OR "page=" AND length>100)