CVE-2024-2982 Overview
CVE-2024-2982 is a command injection vulnerability in the Tenda FH1202 router running firmware version 1.2.0.14(408). The flaw resides in the formWriteFacMac function handling requests to /goform/WriteFacMac. Attackers can manipulate the mac argument to inject arbitrary operating system commands. The vulnerability was assigned identifier VDB-258151, and technical details have been publicly disclosed. Tenda was contacted about the issue but did not respond, and no vendor patch is available.
Critical Impact
Authenticated attackers with low privileges can execute arbitrary commands on the router with elevated privileges, leading to full device compromise and pivoting into the internal network.
Affected Products
- Tenda FH1202 hardware router
- Tenda FH1202 firmware version 1.2.0.14(408)
- Deployments exposing the web management interface on untrusted networks
Discovery Timeline
- 2024-03-27 - CVE-2024-2982 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-2982
Vulnerability Analysis
The vulnerability is a command injection flaw classified under [CWE-77]. The formWriteFacMac handler in the Tenda FH1202 web management binary processes the mac parameter from HTTP requests sent to /goform/WriteFacMac. The handler passes the user-supplied value into an operating system command without sanitization or safe-argument APIs. Attackers who append shell metacharacters to the mac parameter cause the injected payload to execute in the router's shell context.
Successful exploitation grants command execution on the underlying Linux-based firmware, typically with root privileges given the embedded environment. Attackers can modify configuration, extract credentials, pivot to internal hosts, or install persistent implants on the device.
Root Cause
The root cause is missing input validation and unsafe command construction in the formWriteFacMac function. The firmware concatenates the attacker-controlled mac parameter directly into a system command string. This pattern allows shell metacharacters such as ;, |, and backticks to break out of the intended command context.
Attack Vector
Exploitation requires network access to the router's web management interface and low-privilege authentication. Attackers send a crafted HTTP request to /goform/WriteFacMac with a mac value that includes shell metacharacters and appended commands. The injected commands execute inline as part of the handler's system call. Public exploit information has been documented in the IoT vulnerability repository and VulDB entry #258151.
No verified proof-of-concept code is reproduced here. Refer to the linked references for technical exploitation details.
Detection Methods for CVE-2024-2982
Indicators of Compromise
- HTTP POST requests to /goform/WriteFacMac containing shell metacharacters such as ;, |, &, `, or $() in the mac parameter.
- Unexpected outbound connections initiated by the router to attacker-controlled infrastructure.
- New processes, cron entries, or configuration changes on the device that do not match legitimate administrative activity.
Detection Strategies
- Inspect web server and management-interface logs for requests to /goform/WriteFacMac with malformed MAC address values.
- Deploy network intrusion detection signatures that flag command-injection payloads targeting Tenda goform endpoints.
- Correlate authentication events on the router with subsequent anomalous traffic to identify credential abuse leading to exploitation.
Monitoring Recommendations
- Restrict management-plane access to trusted administrative VLANs and monitor any lateral traffic to the router's HTTP interface.
- Baseline outbound DNS and HTTP traffic from the router itself; any unexpected egress warrants investigation.
- Forward router syslog and NetFlow data to a centralized analytics platform for retention and correlation.
How to Mitigate CVE-2024-2982
Immediate Actions Required
- Remove Tenda FH1202 devices from any internet-exposed segments and disable remote management on the WAN interface.
- Rotate administrative credentials on the router and downstream systems that share credentials.
- Segment affected routers behind an upstream firewall that filters inbound HTTP traffic to /goform/ endpoints.
Patch Information
No vendor patch is available. The Tenda security team was contacted through the disclosure process documented in VulDB #258151 but did not respond. Organizations operating the FH1202 running firmware 1.2.0.14(408) should treat the device as unpatched and plan replacement with a supported model.
Workarounds
- Disable the web management interface on untrusted networks and require VPN access for administration.
- Enforce ACLs on upstream network devices that block unsolicited HTTP requests to the router's management port.
- Replace end-of-support Tenda FH1202 hardware with actively maintained equipment that receives security updates.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
