CVE-2024-3009: Tenda FH1205 Firmware RCE Vulnerability

CVE-2024-3009 Overview

CVE-2024-3009 is a command injection vulnerability in the Tenda FH1205 router running firmware version 2.0.0.7(775). The flaw resides in the formWriteFacMac function handling requests to the /goform/WriteFacMac endpoint. Attackers can manipulate the mac argument to inject arbitrary operating system commands. The vulnerability is exploitable remotely by an authenticated attacker with low privileges.

Critical Impact
Successful exploitation allows remote command execution on the router with device-level privileges, enabling full compromise of the affected network device.

Affected Products

Tenda FH1205 hardware device
Tenda FH1205 firmware version 2.0.0.7(775)
Deployments exposing the router web management interface

Discovery Timeline

2024-03-28 - CVE-2024-3009 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-3009

Vulnerability Analysis

The vulnerability is classified as command injection [CWE-77]. The affected code path is the formWriteFacMac handler bound to /goform/WriteFacMac on the Tenda FH1205 web management service. The handler accepts a mac parameter from client requests and passes the value into a shell context without sufficient sanitization. An attacker who can reach the web interface can append shell metacharacters to the mac parameter and execute arbitrary commands in the router's operating system. The EPSS score of 7.932% (94th percentile) reflects observed exploitation interest for this class of Tenda IoT flaw.

Root Cause

The root cause is improper neutralization of special elements used in an OS command. Input supplied to the mac argument reaches a command execution primitive without allowlist validation or shell escaping. Tenda did not respond to the disclosure attempt, and no vendor patch reference is available in the CVE data.

Attack Vector

Exploitation requires network access to the router administrative interface and low-privileged credentials. The attacker sends a crafted HTTP POST request to /goform/WriteFacMac with a mac value containing shell metacharacters such as backticks, $(), or command separators. Public proof-of-concept details are hosted in the GitHub PoC repository and referenced by VulDB entry #258295.

See the GitHub PoC repository for the exact request format and injected payload structure.

Detection Methods for CVE-2024-3009

Indicators of Compromise

HTTP POST requests to /goform/WriteFacMac originating from untrusted sources or unusual internal hosts
mac parameter values containing shell metacharacters such as ;, |, &, backticks, or $()
Unexpected outbound connections from the router to attacker-controlled infrastructure following administrative HTTP traffic

Detection Strategies

Inspect web traffic to Tenda management interfaces for anomalies in POST body content, especially non-hexadecimal characters in mac fields
Correlate router configuration changes with the source IP and timestamp of /goform/WriteFacMac requests
Use network flow analysis to identify routers initiating outbound traffic to non-vendor destinations

Monitoring Recommendations

Log and alert on all administrative HTTP requests reaching router management endpoints from outside a defined management VLAN
Baseline normal firmware update and provisioning traffic patterns, then alert on deviations
Forward router syslog and network telemetry to a centralized data lake for retention and query

How to Mitigate CVE-2024-3009

Immediate Actions Required

Restrict access to the router administrative interface to trusted management networks only
Rotate administrative credentials on all Tenda FH1205 devices and remove default accounts
Disable remote WAN-side management on affected devices until a fix is available
Audit device logs for previous requests to /goform/WriteFacMac with suspicious mac values

Patch Information

No vendor patch has been published in the referenced CVE data. Tenda did not respond to the coordinated disclosure attempt documented in the VulDB advisory. Organizations operating the FH1205 should consider replacing the device or applying compensating network controls until Tenda releases a firmware update.

Workarounds

Place affected routers behind a segmented management network with ACLs blocking HTTP access from user and internet-facing zones
Terminate administrative sessions with a VPN gateway that enforces multi-factor authentication
Deploy an inline reverse proxy or WAF rule that rejects mac parameter values not matching the pattern ^[0-9A-Fa-f:]{12,17}$

bash

# Example firewall restriction limiting management access to a jump host
iptables -A INPUT -p tcp --dport 80 -s 10.10.0.5 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -s 10.10.0.5 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP