CVE-2024-30624: Tenda FH1205 Buffer Overflow Vulnerability

CVE-2024-30624 Overview

CVE-2024-30624 is a stack overflow vulnerability affecting Tenda FH1205 routers running firmware version 2.0.0.7(775). The flaw resides in the saveParentControlInfo function, where the urls parameter is copied to a fixed-size stack buffer without proper bounds checking. An adjacent-network attacker can send a crafted request to trigger memory corruption, leading to denial of service or arbitrary code execution on the device. The vulnerability is classified under [CWE-121: Stack-based Buffer Overflow].

Critical Impact
An unauthenticated attacker on the adjacent network can corrupt stack memory in the router's web management service, resulting in device crash or remote code execution with router-level privileges.

Affected Products

Tenda FH1205 hardware device
Tenda FH1205 firmware version 2.0.0.7(775)
Deployments exposing the router web management interface on Wi-Fi or LAN segments

Discovery Timeline

2024-03-29 - CVE-2024-30624 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-30624

Vulnerability Analysis

The Tenda FH1205 exposes a web-based management interface that handles parental control configuration through the saveParentControlInfo handler. This handler accepts a urls parameter representing the list of URLs to block or monitor. The function copies the attacker-controlled string into a stack-allocated buffer using an unbounded string operation. When the supplied urls value exceeds the buffer size, adjacent stack memory is overwritten, including the saved return address.

An attacker connected to the adjacent network segment can send an HTTP POST request containing an oversized urls value. Because the request does not require authentication in vulnerable configurations, exploitation requires only network reachability. Successful exploitation corrupts control-flow data on the stack, giving the attacker the ability to redirect execution or crash the httpd process managing the router.

Root Cause

The root cause is missing input length validation on the urls parameter before it is copied into a fixed-size stack buffer inside saveParentControlInfo. The MIPS-based binary in FH1205 firmware performs no bounds check, so the copy proceeds until the source string terminator is reached. This pattern is common across Tenda consumer routers and maps directly to [CWE-121].

Attack Vector

The attack originates from an adjacent network position such as the same Wi-Fi network or LAN segment as the router. The attacker submits a crafted HTTP request to the parental control endpoint with a urls parameter containing a long payload. Technical reproduction details are documented in the GitHub IoT Vulnerability Documentation. No public exploit code is currently indexed in Exploit-DB, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified proof-of-concept code is available. Refer to the GitHub reference above for the parameter path and reproduction steps.

Detection Methods for CVE-2024-30624

Indicators of Compromise

HTTP POST requests to the router web interface targeting the parental control endpoint with unusually long urls parameter values
Repeated crashes or reboots of the router httpd process observed in device logs
Unexpected changes to parental control configuration entries on the FH1205
Outbound connections from the router to unknown hosts, indicating post-exploitation activity

Detection Strategies

Inspect HTTP traffic to router management interfaces for urls parameter values that exceed reasonable length thresholds
Monitor for anomalous administrative requests originating from client devices that do not normally manage the router
Correlate router reboot events with preceding HTTP requests to the parental control handler

Monitoring Recommendations

Forward router syslog data to a centralized log platform and alert on repeated httpd restarts
Segment router management interfaces onto a dedicated VLAN and monitor east-west traffic to that segment
Track firmware versions across deployed Tenda devices to identify hosts still running 2.0.0.7(775)

How to Mitigate CVE-2024-30624

Immediate Actions Required

Restrict access to the router web management interface to trusted management hosts only
Disable remote management and confirm that the parental control feature is not exposed to untrusted networks
Change default router credentials and enforce WPA2 or WPA3 on Wi-Fi networks to limit adjacent-network exposure
Inventory Tenda FH1205 devices running firmware 2.0.0.7(775) and prioritize their replacement or isolation

Patch Information

No vendor patch has been referenced in the NVD record or vendor advisories at the time of publication. Users should monitor the Tenda support portal for firmware updates addressing the saveParentControlInfo handler. If no patch becomes available, consider replacing the device with a supported model.

Workarounds

Place the FH1205 behind an upstream firewall and block inbound access to the management interface from all client subnets except an administrative VLAN
Disable the parental control feature if it is not required, reducing the exposed attack surface of the saveParentControlInfo handler
Enforce network segmentation so that guest and IoT clients cannot reach the router management interface directly

bash

# Example: restrict router management access with an upstream firewall rule
iptables -A FORWARD -d 192.168.0.1 -p tcp --dport 80 -s 192.168.100.0/24 -j ACCEPT
iptables -A FORWARD -d 192.168.0.1 -p tcp --dport 80 -j DROP