CVE-2024-41459

Tenda FH1201 v1.2.0.14 was discovered to contain a stack-based buffer overflow vulnerability via the PPPOEPassword parameter at ip/goform/QuickIndex

High · published July 24, 2024

CVSS v3.1
8.8
EPSS
1%
Percentile
48.6
In the wild
Unconfirmed
What it is

⚡ A stack-based buffer overflow lurking in Tenda FH1201 could let attackers take control, and it all starts with a sneaky parameter! Think of it like a suitcase that can hold way more than it should — if too much is packed inside, it bursts open and spills its contents everywhere. This vulnerability lets attackers overflow the buffer and run their own malicious code, like an uninvited guest taking over the party! An attacker could exploit this flaw to inject and execute arbitrary code on the router, potentially leading to a full compromise of the device. This could allow unauthorized access to your network, leaving your sensitive data exposed and your internet safety absolutely devastated!

Put simply

Think of it like a suitcase that can hold way more than it should — if too much is packed inside, it bursts open and spills its contents everywhere. This vulnerability lets attackers overflow the buffer and run their own malicious code, like an uninvited guest taking over the party! This vulnerability occurs through a stack-based buffer overflow via the PPPOEPassword parameter at the QuickIndex interface, allowing for the execution of arbitrary code if exploited.

What to do

An attacker could exploit this flaw to inject and execute arbitrary code on the router, potentially leading to a full compromise of the device. This could allow unauthorized access to your network, leaving your sensitive data exposed and your internet safety absolutely devastated! To protect yourself, update the Tenda FH1201 firmware to version 1.2.0.15 immediately. Make sure to review and restrict access to the configuration interface to trusted users only! You’ve got this! With these steps, you can secure your router and keep your network safe! 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00611 · 48.6th percentile
Published
2024-07-24T00:00Z
EPSS history
Timeline
  • 24 JUL 00:00Z
    Tenda FH1201 v1.2.0.14 was discovered to contain a stack-based buffer overflow vulnerability via the PPPOEPassword parameter at ip/goform/QuickIndex
    cvelistv5