CVE-2024-30627: Tenda FH1205 Buffer Overflow Vulnerability

CVE-2024-30627 Overview

CVE-2024-30627 is a stack-based buffer overflow [CWE-121] in the Tenda FH1205 router running firmware version 2.0.0.7(775). The flaw resides in the saveParentControlInfo function, which fails to validate the length of the deviceId parameter before copying it into a fixed-size stack buffer. An authenticated attacker on the network can send a crafted HTTP request to trigger memory corruption. Successful exploitation can lead to denial of service or arbitrary code execution on the device. A public proof-of-concept exists on GitHub, increasing the risk of opportunistic exploitation against exposed devices.

Critical Impact
Network-adjacent attackers with low privileges can corrupt the router's stack and potentially execute arbitrary code, compromising the confidentiality, integrity, and availability of the device and the network behind it.

Affected Products

Tenda FH1205 hardware device
Tenda FH1205 firmware version 2.0.0.7(775)
Deployments exposing the router's web management interface to untrusted networks

Discovery Timeline

2024-03-29 - CVE-2024-30627 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-30627

Vulnerability Analysis

The vulnerability affects the saveParentControlInfo handler in the Tenda FH1205 web management interface. This handler processes parental control configuration submitted through HTTP requests. The deviceId parameter supplied by the client is copied into a fixed-size stack buffer without length validation. Sending an overly long deviceId value overwrites adjacent stack memory, including the saved return address.

Corrupting the return address on ARM/MIPS-based SOHO routers typically allows an attacker to redirect execution flow. Because the Tenda FH1205 firmware lacks robust exploit mitigations found on general-purpose operating systems, chaining the overflow with return-oriented programming techniques is feasible. The result is code execution in the context of the router's HTTP daemon, which usually runs with elevated privileges.

Root Cause

The root cause is missing bounds checking on attacker-controlled input. The saveParentControlInfo function trusts the size of the deviceId HTTP parameter and uses an unsafe copy operation into a stack-allocated buffer. This pattern is characteristic of [CWE-121] stack-based buffer overflow defects common in embedded web interfaces.

Attack Vector

Exploitation requires network access to the router's management interface and low-privilege authenticated access. An attacker sends a POST request to the vulnerable endpoint with an oversized deviceId value. The overflow overwrites saved registers and the return address on the stack, enabling denial of service or arbitrary code execution. Technical details and reproduction steps are documented in the GitHub proof-of-concept.

Detection Methods for CVE-2024-30627

Indicators of Compromise

HTTP POST requests to the saveParentControlInfo endpoint containing abnormally long deviceId parameter values
Repeated crashes or reboots of the Tenda FH1205 router without operator action
Unexpected outbound connections originating from the router's management IP
Configuration changes to parental control settings that do not match administrator activity

Detection Strategies

Inspect web server and router logs for requests to saveParentControlInfo with parameter values exceeding typical device identifier lengths (16-64 bytes)
Deploy network intrusion detection signatures that flag HTTP payloads targeting the vulnerable endpoint with oversized parameters
Baseline normal administrative traffic to the router and alert on deviations in request size, frequency, or source

Monitoring Recommendations

Forward router syslog and HTTP access logs to a centralized SIEM for retention and correlation
Monitor for management-plane access from unexpected internal hosts or external IP addresses
Track firmware version and configuration drift across all Tenda devices in the environment

How to Mitigate CVE-2024-30627

Immediate Actions Required

Restrict access to the router's web management interface to trusted management VLANs only
Disable remote (WAN-side) administration if it is enabled
Rotate administrative credentials and enforce strong, unique passwords to reduce the risk of the low-privilege prerequisite being met
Inventory all Tenda FH1205 devices running firmware 2.0.0.7(775) and prioritize them for remediation

Patch Information

At the time of publication, no vendor advisory or fixed firmware release is referenced in the NVD entry for CVE-2024-30627. Administrators should monitor the Tenda support portal for updated firmware. Where no patch is available, consider replacing end-of-life or unsupported devices with actively maintained hardware.

Workarounds

Place the router behind a network segment that blocks untrusted hosts from reaching the HTTP management port
Apply ACLs on upstream switches or firewalls to permit management traffic only from designated administrator workstations
Disable parental control features if they are not required, reducing exposure of the saveParentControlInfo handler
Reboot affected devices on a defined schedule to clear transient stack corruption artifacts until a firmware fix is available

bash

# Example: restrict router management access to a single admin host using iptables on an upstream Linux gateway
iptables -A FORWARD -p tcp -d 192.0.2.1 --dport 80 -s 192.0.2.50 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.0.2.1 --dport 80 -j DROP