CVE-2024-46047 in FH451
Summary
by MITRE • 09/13/2024
Tenda FH451 v1.0.0.9 has a stack overflow vulnerability in the fromDhcpListClient function.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 05/25/2026
The Tenda FH451 v1.0.0.9 router firmware contains a critical stack overflow vulnerability within the fromDhcpListClient function, representing a significant security weakness that could enable remote code execution. This vulnerability arises from insufficient input validation and bounds checking when processing DHCP client list data, creating an exploitable condition where maliciously crafted input can overwrite adjacent stack memory. The flaw exists in the router's web interface handling of DHCP client information, specifically when parsing and processing client data submitted through web forms or API calls. Attackers can leverage this vulnerability by sending specially crafted DHCP client list data that exceeds the allocated stack buffer size, leading to memory corruption and potential arbitrary code execution with the privileges of the web server process. The vulnerability falls under CWE-121 Stack-based Buffer Overflow, which is classified as a high-risk issue in the Common Weakness Enumeration catalog and aligns with ATT&CK technique T1059.007 for command and scripting interpreter. This stack overflow represents a severe threat to network security as it allows remote attackers to gain unauthorized access to the device, potentially enabling them to modify router configurations, intercept network traffic, or establish persistent backdoors.
The operational impact of this vulnerability extends beyond simple remote code execution to encompass complete device compromise and network infiltration. An attacker who successfully exploits this vulnerability can manipulate the router's core functionality, including DNS settings, firewall rules, and port forwarding configurations. The stack overflow can also lead to denial of service conditions where the router becomes unresponsive or crashes, disrupting network connectivity for all connected devices. Additionally, the vulnerability may enable attackers to perform man-in-the-middle attacks by modifying the router's routing tables or DNS resolution behavior, allowing them to redirect traffic to malicious destinations. The compromised device can then serve as a pivot point for attacking other systems within the local network, making this vulnerability particularly dangerous in enterprise or residential gateway environments where the router serves as the primary network access point. The exploitation of this vulnerability requires minimal privileges and can be performed remotely without authentication, making it an attractive target for automated exploitation tools and malware campaigns.
Mitigation strategies for this vulnerability must address both immediate remediation and long-term security improvements to protect against exploitation. The primary recommendation involves updating to the latest firmware version from Tenda, which should contain patches addressing the stack overflow condition through proper input validation and buffer size enforcement. Network administrators should also implement network segmentation and access controls to limit exposure of affected devices to untrusted networks. Security monitoring should include detection of unusual DHCP activity and web interface access patterns that might indicate exploitation attempts. Additionally, implementing network intrusion detection systems can help identify and block malicious traffic patterns associated with exploitation attempts. The vulnerability demonstrates the importance of proper software security practices including input validation, buffer overflow protection mechanisms, and regular security assessments. Organizations should also consider implementing device authentication and authorization controls to prevent unauthorized access to router management interfaces, and establish regular firmware update policies to ensure all network devices maintain current security patches. These measures align with industry best practices for embedded system security and help prevent similar vulnerabilities from being exploited in other network infrastructure devices.