CVE-2024-42955 in FH1201
Summary
by MITRE • 08/15/2024
Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the page parameter in the fromSafeClientFilter function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/17/2024
The vulnerability identified as CVE-2024-42955 affects the Tenda FH1201 router model running firmware version 1.2.0.14 build 408. This device represents a common consumer-grade networking equipment that serves as a gateway for home and small office networks, making it a potentially attractive target for attackers seeking to disrupt network services or gain unauthorized access. The vulnerability manifests within the web interface management functionality, specifically within the fromSafeClientFilter function that processes incoming HTTP requests. This particular implementation flaw demonstrates a classic stack buffer overflow condition that occurs when untrusted input data exceeds the allocated buffer space in memory.
The technical exploitation of this vulnerability occurs through a carefully crafted POST request that targets the page parameter within the fromSafeClientFilter function. When the router processes this malformed input, the excessive data overflows the allocated stack buffer, causing the program to crash or behave unpredictably. This stack overflow condition directly maps to CWE-121, which describes stack-based buffer overflow vulnerabilities where insufficient bounds checking allows attackers to overwrite adjacent memory locations. The vulnerability's impact is limited to a denial of service condition, as the attacker cannot directly execute arbitrary code or gain persistent access to the device, but the service disruption can effectively render the network gateway inaccessible to legitimate users.
From an operational perspective, this vulnerability creates significant risk for network availability and business continuity, particularly in environments where uninterrupted network access is critical. The DoS condition can be triggered remotely without authentication requirements, making it particularly dangerous as it allows any attacker with network access to potentially disrupt services. The attack vector through HTTP POST requests means that the vulnerability could be exploited through web-based attack frameworks or automated scanning tools, amplifying the potential impact. Network administrators may face challenges in detecting such attacks since they appear as legitimate service disruptions rather than obvious malicious activity.
The exploitation of this vulnerability aligns with ATT&CK technique T1499.004 which covers network disruption through resource exhaustion or service interruption. The lack of input validation in the web interface represents a fundamental security weakness that violates secure coding practices recommended by industry standards. Organizations should implement immediate mitigation measures including firmware updates from the vendor, network segmentation to isolate affected devices, and monitoring for suspicious POST request patterns. Additionally, network administrators should consider implementing web application firewalls to filter malicious requests and disable unnecessary web management interfaces when possible. The vulnerability highlights the importance of regular firmware updates and security assessments for network infrastructure devices, particularly those with exposed web interfaces that are often overlooked in traditional security monitoring.