CVE-2024-30587

Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the urls parameter of the saveParentControlInfo function

Critical · published March 28, 2024

CVSS v3.1
9.8
EPSS
1%
Percentile
56.4
In the wild
Unconfirmed
What it is

🚨 A critical stack overflow lurks in Tenda FH1202, just waiting for a crafty attacker to exploit the URLs parameter in the saveParentControlInfo function! 🔥 Think of this flaw as a crowded restaurant where one too many diners push their chairs in at the same time; it can cause a chaotic collapse. In this case, the stack overflow can lead to uncontrolled behavior, putting your device at risk. An attacker could potentially disrupt your device's operations entirely, opening the door to unauthorized access or even remote code execution. This could lead to a catastrophic loss of control over the router, allowing them to manipulate settings or intercept your data.

Put simply

Think of this flaw as a crowded restaurant where one too many diners push their chairs in at the same time; it can cause a chaotic collapse. In this case, the stack overflow can lead to uncontrolled behavior, putting your device at risk. This stack overflow vulnerability occurs when excessive data is provided to the urls parameter in the saveParentControlInfo function, overwhelming the stack and leading to unpredictable behavior.

What to do

An attacker could potentially disrupt your device's operations entirely, opening the door to unauthorized access or even remote code execution. This could lead to a catastrophic loss of control over the router, allowing them to manipulate settings or intercept your data. Update the firmware to version 1.2.0.15 or later to patch this vulnerability. It's also wise to review your device settings and limit access to trusted users only. Regular monitoring is key to maintaining security! You've got this! By taking action now, you're one step closer to securing your network! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00807 · 56.4th percentile
Published
2024-03-28T00:00Z
EPSS history
Timeline
  • 28 MAR 00:00Z
    Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the urls parameter of the saveParentControlInfo function
    cvelistv5