CVE-2024-2991: Tenda FH1203 Firmware RCE Vulnerability

CVE-2024-2991 Overview

CVE-2024-2991 is a command injection vulnerability in the Tenda FH1203 router running firmware version 2.0.1.6. The flaw resides in the formWriteFacMac function handling requests to the /goform/WriteFacMac endpoint. Attackers can manipulate the mac argument to inject arbitrary operating system commands. The issue is classified under CWE-77 (Improper Neutralization of Special Elements used in a Command).

The vulnerability is exploitable remotely over the network and requires low privileges. Public disclosure occurred without vendor acknowledgment, and the exploit details have been made available through third-party research repositories.

Critical Impact
Successful exploitation allows remote command execution on affected Tenda FH1203 devices, resulting in full compromise of the router and pivot opportunities into the internal network.

Affected Products

Tenda FH1203 (hardware)
Tenda FH1203 Firmware version 2.0.1.6
Deployments exposing the router web management interface to untrusted networks

Discovery Timeline

2024-03-27 - CVE-2024-2991 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-2991

Vulnerability Analysis

The defect exists in the formWriteFacMac handler served under the /goform/WriteFacMac URI of the Tenda FH1203 web management interface. This handler accepts a mac parameter intended to program the device's factory MAC address. The firmware passes the attacker-controlled mac string into a shell context without validating or sanitizing shell metacharacters.

An authenticated attacker on the network can append arbitrary shell operators such as ;, |, or backticks to the mac value. The injected payload executes with the privileges of the web server process on the router, which typically runs as root on Tenda embedded devices. Public technical documentation for this issue is available in the IoT vulnerability research repository and in VulDB entry #258160.

Root Cause

The root cause is missing input validation on the mac parameter before it is concatenated into a system command string. The firmware treats the input as trusted data and forwards it to a shell interpreter, satisfying the classic pattern described in CWE-77. No allow-list, escaping, or safe execution API is applied.

Attack Vector

Attackers deliver a crafted HTTP POST request to /goform/WriteFacMac containing a malicious mac value. The request originates from any network path with access to the router management interface, including LAN, adjacent VLANs, or the WAN interface when remote management is enabled. Post-exploitation activity commonly includes deploying botnet payloads, modifying DNS settings, and establishing persistence on the device.

No verified exploit code is bundled with this advisory. Technical write-ups referenced above describe the parameter format and command-injection payload structure.

Detection Methods for CVE-2024-2991

Indicators of Compromise

HTTP POST requests to /goform/WriteFacMac containing shell metacharacters (;, |, &, `, $() in the mac field
Outbound connections from the router to unfamiliar IP addresses shortly after receipt of a WriteFacMac request
Unexpected processes, cron entries, or iptables rules present on the router after remote administration events
Firmware integrity mismatches or altered /etc configuration files on the device

Detection Strategies

Inspect web-proxy and firewall logs for POST requests targeting Tenda /goform/ endpoints, particularly WriteFacMac
Alert on HTTP request bodies where the mac parameter does not match the strict XX:XX:XX:XX:XX:XX hexadecimal format
Correlate router administrative requests with subsequent outbound traffic to non-corporate destinations

Monitoring Recommendations

Ingest router syslog and NetFlow telemetry into a centralized analytics platform for behavioral baselining
Monitor for scanner activity probing /goform/ URIs across the routable IP range of managed sites
Track firmware versions across the fleet and flag any FH1203 devices running 2.0.1.6

How to Mitigate CVE-2024-2991

Immediate Actions Required

Restrict access to the router management interface to trusted administrative subnets using ACLs
Disable remote WAN-side management on all Tenda FH1203 devices
Change default administrative credentials and enforce strong password policies to limit the pool of authenticated attackers
Segment IoT and networking equipment away from user and server VLANs

Patch Information

According to the disclosure record, the vendor was contacted early but did not respond and no security patch has been referenced in the NVD entry or in VulDB #258160. Operators should track the Tenda support portal for firmware updates and apply any released version above 2.0.1.6 as soon as it becomes available.

Workarounds

Place the FH1203 behind a network firewall that blocks inbound access to TCP/80 and TCP/443 on the router
Use a web application firewall or router-fronting proxy to drop requests to /goform/WriteFacMac containing non-hexadecimal characters in the mac parameter
Replace end-of-support Tenda FH1203 hardware with a currently supported device where feasible

bash

# Example firewall rule restricting management interface to a trusted admin subnet
# Apply on the upstream firewall protecting the Tenda FH1203
iptables -A FORWARD -p tcp -s 10.10.50.0/24 -d 192.0.2.10 --dport 80 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.0.2.10 --dport 80 -j DROP
iptables -A FORWARD -p tcp -d 192.0.2.10 --dport 443 -j DROP