CVE-2024-42941 in FH1201
Summary
by MITRE • 08/15/2024
Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the wanmode parameter in the fromAdvSetWan function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/03/2024
The vulnerability identified as CVE-2024-42941 affects the Tenda FH1201 router model running firmware version 1.2.0.14 build 408. This device is a consumer-grade wireless router that serves as a network gateway and manages various network configuration parameters through its web-based administration interface. The vulnerability resides within the web server component of the router's firmware where it processes incoming HTTP requests containing configuration parameters.
The technical flaw manifests as a stack buffer overflow occurring in the fromAdvSetWan function when processing the wanmode parameter. This function is responsible for handling advanced WAN settings configuration through POST requests sent to the router's web interface. The vulnerability arises from insufficient input validation and bounds checking on the wanmode parameter, which allows an attacker to supply a maliciously crafted string that exceeds the allocated buffer size on the stack. When the router attempts to process this oversized input, it overflows the stack buffer and corrupts adjacent memory locations, leading to unpredictable behavior.
The operational impact of this vulnerability is significant as it enables remote attackers to execute a Denial of Service condition against the affected router. An attacker can craft a specially formatted POST request containing an excessively long wanmode parameter value and submit it to the router's web administration interface. Upon processing this malformed request, the router's web server crashes or becomes unresponsive, effectively rendering the device inaccessible to legitimate users. This DoS condition can persist until the device is manually rebooted or the firmware is updated, potentially disrupting network connectivity for all devices connected to the router.
This vulnerability maps to CWE-121 Stack-based Buffer Overflow, which is a well-documented weakness in software development where data written to a buffer on the stack exceeds the buffer's allocated size. The attack pattern aligns with ATT&CK technique T1499.004 Network Denial of Service, as the vulnerability enables an attacker to disrupt network services through deliberate resource exhaustion or corruption. The vulnerability also demonstrates poor input validation practices that are commonly addressed by security frameworks such as the OWASP Top Ten and the SANS Top 25, particularly in the areas of input validation and memory safety. The exposure of this vulnerability in a consumer device highlights the critical need for proper security testing and code review practices in embedded systems, as these devices often lack the security updates and monitoring capabilities of enterprise-grade systems. Network defenders should implement network segmentation and monitoring to detect anomalous traffic patterns that may indicate exploitation attempts against such devices, while also ensuring that affected routers are promptly updated with patched firmware versions from the vendor.