CVE-2024-42943 in FH1201
Summary
by MITRE • 08/15/2024
Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the PPPOEPassword parameter in the fromAdvSetWan function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/17/2024
The vulnerability identified as CVE-2024-42943 affects the Tenda FH1201 wireless router model running firmware version v1.2.0.14 build 408. This device represents a common consumer-grade networking appliance that handles network configuration through web-based administrative interfaces. The vulnerability manifests within the web server component responsible for processing administrative requests, specifically targeting the fromAdvSetWan function that manages advanced WAN settings. The affected parameter PPPOEPassword demonstrates a critical flaw in input validation and memory management that creates a stack overflow condition when processing malformed user input.
The technical implementation of this vulnerability stems from improper bounds checking within the web application's request handling logic. When an attacker submits a crafted POST request containing an excessively long PPPOEPassword value, the application fails to properly validate the input length before copying it to a fixed-size stack buffer. This classic buffer overflow scenario occurs because the system does not implement adequate input sanitization or length validation mechanisms before passing user-provided data to memory operations. The stack overflow condition typically results in program termination or unpredictable behavior, which in this case manifests as a denial of service state that renders the device inaccessible to legitimate users.
From an operational perspective, this vulnerability presents significant risks to network availability and service continuity. The denial of service impact means that authorized network administrators lose access to their router's administrative interface, preventing them from making necessary configuration changes, monitoring network performance, or troubleshooting connectivity issues. Attackers can exploit this vulnerability remotely without requiring authentication credentials, making it particularly dangerous in environments where network administrators rely on web-based management interfaces. The vulnerability affects the device's core functionality by disrupting the web server process, which typically requires a device reboot to restore normal operation, potentially causing network outages for connected devices.
The vulnerability maps directly to CWE-121, which describes stack-based buffer overflow conditions, and aligns with ATT&CK technique T1499.004 for network denial of service attacks. This classification indicates that the vulnerability represents a persistent threat vector that can be exploited by automated scanning tools to identify and compromise vulnerable devices across networks. Network security professionals should consider implementing network segmentation to limit exposure of such devices to external threats, while also ensuring that firmware updates are applied promptly to address known vulnerabilities. The remediation approach requires either patching the affected firmware version or replacing the vulnerable device with a model that has been updated to address the buffer overflow condition through proper input validation mechanisms. Organizations should also implement network monitoring to detect anomalous traffic patterns that might indicate exploitation attempts targeting this specific vulnerability.