CVE-2024-42952 in FH1201
Summary
by MITRE • 08/15/2024
Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the page parameter in the fromqossetting function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 03/18/2025
The vulnerability identified as CVE-2024-42952 affects the Tenda FH1201 router model running firmware version v1.2.0.14 build 408. This issue represents a stack buffer overflow condition that occurs within the web interface handling code of the device. The vulnerability specifically manifests in the fromqossetting function where the page parameter is processed without adequate bounds checking. This flaw exists within the router's HTTP server implementation that handles administrative web requests, making it accessible through standard network communication channels.
The technical exploitation of this vulnerability occurs through a crafted POST request that targets the web interface of the affected device. When the page parameter is submitted with malicious input exceeding the allocated stack buffer size, it results in a stack overflow condition. This overflow corrupts adjacent memory locations and can lead to unpredictable behavior including application crashes, system instability, and ultimately denial of service. The vulnerability is classified as a classic stack-based buffer overflow with a CWE-121 classification, representing a critical weakness in memory protection mechanisms. The attack vector requires no authentication and can be executed remotely over the network, making it particularly dangerous for networked devices.
The operational impact of this vulnerability extends beyond simple denial of service conditions. While the primary effect is a DoS attack that renders the router's web management interface unavailable, the underlying memory corruption could potentially provide a foothold for more sophisticated attacks. Network administrators may experience service disruption as the affected device becomes unresponsive to legitimate administrative requests. The vulnerability affects the router's ability to maintain normal network operations through its web interface, which is commonly used for configuration management, status monitoring, and quality of service settings. This impacts both home and enterprise network environments where the device serves as a critical connectivity point.
Mitigation strategies for CVE-2024-42952 should prioritize immediate firmware updates from Tenda if available, as this represents the most effective solution to address the root cause. Network segmentation and firewall rules can provide temporary protection by restricting access to the affected web interface from untrusted networks. Implementing monitoring solutions to detect anomalous POST request patterns targeting the router's web interface can help identify exploitation attempts. The vulnerability aligns with ATT&CK technique T1210 for exploitation of remote services and T1499 for network disruption. Organizations should also consider disabling unnecessary web management interfaces and implementing secure network practices such as using strong authentication and regular security assessments to prevent unauthorized access to network devices.