CVE-2023-37712 in AC1206
Summary
by MITRE • 07/10/2023
Tenda AC1206 V15.03.06.23, F1202 V1.2.0.20(408), and FH1202 V1.2.0.20(408) were discovered to contain a stack overflow in the page parameter in the fromSetIpBind function.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 01/18/2026
The vulnerability identified as CVE-2023-37712 affects multiple Tenda wireless router models including the AC1206 V15.03.06.23, F1202 V1.2.0.20(408), and FH1202 V1.2.0.20(408) firmware versions. This represents a critical stack overflow condition that occurs within the web interface handling of these networking devices, specifically when processing the page parameter in the fromSetIpBind function. The flaw exists in the device's HTTP server implementation where user-supplied input is not properly validated or sanitized before being processed. When an attacker sends a specially crafted request containing an overly long page parameter value, the application fails to enforce bounds checking on the stack buffer allocated for processing this parameter. This vulnerability falls under the CWE-121 stack-based buffer overflow category, which is classified as a serious memory corruption vulnerability that can lead to arbitrary code execution or system crashes.
The technical exploitation of this vulnerability requires an attacker to send a malicious HTTP request to the affected device's web management interface. The fromSetIpBind function processes the page parameter without adequate input length validation, allowing an attacker to overflow the stack buffer and potentially overwrite adjacent memory locations including return addresses and function pointers. This type of vulnerability is particularly dangerous because it can be exploited remotely without authentication, given that the web interface is accessible to network users. The attack vector follows the ATT&CK technique T1210 known as "Exploitation of Remote Services," where adversaries leverage unpatched vulnerabilities in network services to gain unauthorized access. The stack overflow condition creates a predictable memory corruption pattern that can be leveraged for privilege escalation or complete system compromise, making it a high-severity issue for network infrastructure devices.
The operational impact of this vulnerability extends beyond simple device instability, as it represents a potential gateway for broader network compromise. Network administrators who rely on these devices for their wireless infrastructure face significant risk since the vulnerability can be exploited by remote attackers without requiring physical access or prior authentication. The affected devices are commonly deployed in residential and small office environments where network monitoring may be limited, making exploitation more likely to go undetected. This vulnerability could enable attackers to gain full administrative control over the affected routers, potentially allowing them to redirect traffic, install malware, or establish persistent backdoors within the network. The exploitation could also lead to denial of service conditions that disrupt network connectivity for legitimate users. Organizations using these devices should consider the potential for lateral movement within their networks, as compromised routers can serve as stepping stones for attacks on internal systems. The vulnerability's presence in multiple firmware versions suggests that this may be a systemic issue in the device's web application architecture rather than an isolated incident.
Mitigation strategies for this vulnerability should include immediate firmware updates from Tenda to address the stack overflow condition in the affected models. Network administrators should also implement network segmentation to limit access to device management interfaces and consider disabling remote management features where possible. The implementation of web application firewalls and intrusion detection systems can help detect and prevent exploitation attempts targeting this specific vulnerability. Additionally, organizations should conduct comprehensive vulnerability assessments to identify all devices running the affected firmware versions and ensure proper network monitoring is in place to detect anomalous traffic patterns that may indicate exploitation attempts. Regular security audits of network infrastructure devices remain critical for identifying similar vulnerabilities that may not yet be publicly disclosed but could pose equivalent risks to network security.