CVE-2024-42987
Published: 15 August 2024
Summary
CVE-2024-42987 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Tenda Fh1206 Firmware. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 7.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Tenda FH1206 firmware version 02.03.01.35 contains a stack-based buffer overflow in the fromPptpUserAdd function. The flaw arises when the modino, username, newpwd, or pptpdnetseg parameters supplied in an HTTP POST request are copied via unsafe sprintf calls that lack length checks, triggering CWE-787.
A remote unauthenticated attacker can send a single crafted POST request to the affected device to overflow the stack. Successful exploitation produces a denial of service; under favorable memory conditions the same primitive may permit remote code execution.
Public proof-of-concept code demonstrating each of the four trigger parameters has been published on GitHub. The EPSS score has remained flat at 0.0842 since disclosure, indicating no measurable increase in observed exploitation activity. No vendor advisory or firmware update addressing the issue appears among the referenced sources.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-39864
Vulnerability details
Tenda FH1206 v02.03.01.35 was discovered to contain a stack-based buffer overflow vulnerability in the fromPptpUserAdd function. The vulnerability can be triggered via the modino, username, newpwd, or pptpdnetseg parameters, all of which are passed via HTTP POST and used in…
more
unsafe sprintf calls without proper length validation. A remote attacker can exploit this flaw through a crafted POST request, which may cause a Denial of Service (DoS). In certain scenarios, this issue could potentially be leveraged to achieve remote code execution.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in public-facing router web interface enables remote exploitation of public-facing application (T1190) for potential RCE and reliable DoS via application crash (T1499.004).
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Out-of-bounds writes that corrupt control flow or inject shellcode are rendered non-executable by the same memory protections.