CVE-2024-30591: Tenda FH1202 Buffer Overflow Vulnerability

CVE-2024-30591 Overview

CVE-2024-30591 is a stack-based buffer overflow [CWE-121] in the Tenda FH1202 router running firmware version 1.2.0.14(408). The flaw resides in the saveParentControlInfo function, where the time parameter is copied to a fixed-size stack buffer without bounds validation. An attacker on an adjacent network can send a crafted request to corrupt the stack, causing denial of service or potential arbitrary code execution on the device. Exploitation requires no authentication and no user interaction.

Critical Impact
Adjacent-network attackers can trigger memory corruption in the parental control handler to crash the device or execute code with router privileges.

Affected Products

Tenda FH1202 router (hardware)
Tenda FH1202 firmware version 1.2.0.14(408)
Deployments exposing the router web management interface to adjacent network segments

Discovery Timeline

2024-03-28 - CVE-2024-30591 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-30591

Vulnerability Analysis

The Tenda FH1202 firmware exposes a web management endpoint that processes parental control configuration through the saveParentControlInfo function. The handler accepts a time parameter representing the scheduling window for parental controls. The function copies this attacker-controlled string into a fixed-size stack buffer without verifying the input length.

Because the FH1202 firmware is compiled without modern exploit mitigations typical of consumer IoT devices, an oversized time value overwrites adjacent stack frames, including the saved return address. This condition maps to CWE-121 (Stack-based Buffer Overflow) and enables control-flow hijacking on the MIPS-based router.

Successful exploitation compromises confidentiality, integrity, and availability of the device. An attacker who controls execution can extract credentials, pivot into the internal network, or persist malicious firmware.

Root Cause

The root cause is missing input length validation in the saveParentControlInfo request handler. The time parameter, sourced directly from an HTTP request, is passed to an unsafe string copy routine targeting a bounded stack buffer. No sanitization, length check, or safe copy function guards the operation.

Attack Vector

Exploitation requires network reachability to the router management interface from an adjacent network position, such as the LAN or Wi-Fi segment. The attacker sends a crafted HTTP request to the parental control endpoint with an oversized time value. No authentication is required, and the request needs no user interaction.

The vulnerability is documented in the GitHub IoT Vulnerability Document. No public proof-of-concept exploit code has been indexed in Exploit-DB, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.685%.

Detection Methods for CVE-2024-30591

Indicators of Compromise

HTTP POST requests to parental control management URIs on the FH1202 containing unusually long time parameter values
Unexpected reboots, watchdog resets, or crash logs from the router coinciding with management-interface traffic
Outbound connections from the router to unfamiliar hosts following configuration requests

Detection Strategies

Inspect HTTP traffic to the router management interface for time parameter values exceeding expected schedule string lengths
Monitor for repeated malformed requests to saveParentControlInfo endpoints from LAN or Wi-Fi clients
Alert on router availability changes and management-plane crashes correlated with client-originated web traffic

Monitoring Recommendations

Forward router syslog and management-interface access logs to a centralized SIEM for correlation
Baseline normal parental control configuration traffic and flag statistical deviations in payload size
Segment IoT and management VLANs so that adjacent-network exploitation attempts are visible to network sensors

How to Mitigate CVE-2024-30591

Immediate Actions Required

Restrict access to the FH1202 web management interface to a dedicated administrative VLAN
Disable remote management and confirm the parental control feature is only accessible to trusted administrators
Change default router credentials and audit connected clients on LAN and Wi-Fi segments

Patch Information

At the time of the last NVD update on 2026-06-17, no vendor advisory or fixed firmware release is referenced for CVE-2024-30591. Administrators should monitor Tenda's support channels for an updated firmware image superseding 1.2.0.14(408) and apply it as soon as it is published.

Workarounds

Place the FH1202 behind a firewall that blocks untrusted clients from reaching the management interface
Isolate guest and IoT devices on separate SSIDs and VLANs to reduce adjacent-network exposure
Consider replacing end-of-support consumer routers with hardware that receives active security maintenance

bash

# Example: restrict router management access to a trusted admin subnet on an upstream firewall
iptables -I FORWARD -d 192.0.2.1 -p tcp --dport 80 -s 10.10.10.0/24 -j ACCEPT
iptables -I FORWARD -d 192.0.2.1 -p tcp --dport 80 -j DROP