CVE-2024-30604: Tenda FH1203 Buffer Overflow Vulnerability

CVE-2024-30604 Overview

CVE-2024-30604 is a stack overflow vulnerability in the Tenda FH1203 router running firmware version 2.0.1.6. The flaw resides in the fromDhcpListClient function, where the list1 parameter is processed without proper bounds checking. An unauthenticated remote attacker can send a crafted request to trigger memory corruption on the router's stack, resulting in a denial of service condition.

The vulnerability is tracked under CWE-125: Out-of-bounds Read and affects routers that expose the vulnerable HTTP management interface to attacker-reachable networks.

Critical Impact
Remote unauthenticated attackers can trigger a stack overflow in the fromDhcpListClient handler, causing the device to crash and disrupting network connectivity for all downstream clients.

Affected Products

Tenda FH1203 router (hardware)
Tenda FH1203 firmware version 2.0.1.6
Deployments exposing the web management interface to untrusted networks

Discovery Timeline

2024-03-28 - CVE-2024-30604 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-30604

Vulnerability Analysis

The Tenda FH1203 web management daemon exposes a DHCP client listing endpoint that calls the fromDhcpListClient function. This function reads the list1 HTTP parameter from the incoming request and copies it into a fixed-size stack buffer without validating the input length. When an attacker submits an oversized list1 value, the copy operation overruns the buffer boundary and corrupts adjacent stack memory, including saved return addresses.

The consequence is reliable process termination of the management service, which typically causes the router to reboot or hang. Because the corruption occurs on the stack and overwrites control data, the flaw represents the class of memory safety defects commonly seen in MIPS-based embedded routers. Exploitation requires no authentication and no user interaction.

Root Cause

The root cause is missing length validation on the list1 query parameter before it is consumed by a stack-allocated buffer in fromDhcpListClient. The function trusts attacker-controlled input length, allowing data to be written beyond the buffer boundary. This pattern recurs across Tenda firmware HTTP handlers, where sprintf-style or strcpy-style operations are used without size limits.

Attack Vector

The attack vector is network-based against the router's HTTP administrative interface. An attacker sends an HTTP request to the endpoint that invokes fromDhcpListClient, supplying an overlong value for the list1 parameter. No credentials are required to reach the vulnerable code path. While the published advisory documents only availability impact, untrusted memory corruption on embedded MIPS targets is frequently a precursor to control-flow hijacking research. Technical details and proof-of-concept material are documented in the public GitHub IoT Vulnerability Report.

Detection Methods for CVE-2024-30604

Indicators of Compromise

Unexpected reboots or watchdog resets of the FH1203 device coinciding with inbound HTTP traffic to the management interface
HTTP requests containing abnormally long list1 parameter values directed at DHCP client list endpoints
Crash logs or kernel messages referencing the httpd or web management process on Tenda devices

Detection Strategies

Inspect HTTP traffic destined for the router management interface and flag requests where the list1 parameter exceeds expected length thresholds.
Correlate network packet captures with device availability monitoring to identify crash-and-reboot patterns following malformed requests.
Deploy IDS/IPS signatures that match oversized parameter values targeting fromDhcpListClient URLs.

Monitoring Recommendations

Continuously monitor router uptime and SNMP availability counters to detect repeated unplanned restarts.
Log all access attempts to the FH1203 administrative interface from non-management VLANs.
Alert on HTTP requests to embedded device management URLs originating from external or guest network segments.

How to Mitigate CVE-2024-30604

Immediate Actions Required

Restrict access to the FH1203 web management interface to trusted management VLANs only, blocking it from WAN and guest networks.
Disable remote administration features on the device until a firmware fix is verified and applied.
Place vulnerable routers behind a network segmentation boundary that filters HTTP traffic to the device.

Patch Information

At the time of NVD publication, Tenda has not published a vendor advisory or fixed firmware release for the FH1203 2.0.1.6 line referenced in this CVE. Administrators should monitor the Tenda support portal for updated firmware and apply it as soon as it becomes available. Until a patch is released, treat affected devices as exposed and apply compensating network controls.

Workarounds

Block inbound TCP traffic to the router's HTTP management port from untrusted interfaces using upstream firewall rules.
Replace end-of-support or unpatched Tenda FH1203 units with actively maintained equipment where feasible.
Apply strong administrative credentials and disable Universal Plug and Play (UPnP) to reduce the attack surface adjacent to the affected endpoint.

bash

# Example: restrict management interface access using upstream iptables
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 \
  -m iprange ! --src-range 10.0.0.10-10.0.0.20 -j DROP
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 \
  -m iprange ! --src-range 10.0.0.10-10.0.0.20 -j DROP