CVE-2024-30637: Tenda F1202 Firmware RCE Vulnerability

CVE-2024-30637 Overview

CVE-2024-30637 is a command injection vulnerability in the Tenda F1202 router firmware version 1.2.0.20(408). The flaw resides in the formWriteFacMac function, which fails to sanitize the mac parameter before passing it to a system command. An adjacent-network attacker can inject arbitrary operating system commands that execute with the privileges of the web management process. The weakness is classified under CWE-77: Improper Neutralization of Special Elements used in a Command. Successful exploitation leads to full device compromise.

Critical Impact
Attackers on the adjacent network can execute arbitrary OS commands on affected Tenda F1202 devices, resulting in complete confidentiality, integrity, and availability loss.

Affected Products

Tenda F1202 hardware device
Tenda F1202 firmware version 1.2.0.20(408)
Web management interface exposing the formWriteFacMac endpoint

Discovery Timeline

2024-03-29 - CVE-2024-30637 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-30637

Vulnerability Analysis

The Tenda F1202 router exposes the formWriteFacMac handler through its HTTP administration interface. This handler accepts a mac parameter intended to write the device's factory MAC address. The firmware passes the parameter to an underlying shell command without input validation or neutralization of shell metacharacters. An attacker who can reach the management interface on the adjacent network can append arbitrary commands using shell operators such as ;, |, or backticks. The injected commands run in the context of the router's web service, which typically operates with root privileges on consumer network devices. This grants the attacker persistent control over routing, DNS, and traffic inspection on the affected network segment.

Root Cause

The root cause is missing input sanitization in the formWriteFacMac function. The mac parameter should conform to a strict hexadecimal MAC address format but is concatenated directly into a system command string. Improper neutralization of special elements used in a command [CWE-77] allows shell interpretation of attacker-supplied content.

Attack Vector

Exploitation requires network adjacency to the router's management interface, typically via LAN or Wi-Fi. Authentication is not required according to the published CVSS vector. An attacker crafts an HTTP request to the vulnerable endpoint with a mac value containing shell metacharacters and a follow-on command. The router executes the appended command during MAC address processing. Refer to the public proof-of-concept notes for the request structure and parameter details.

Detection Methods for CVE-2024-30637

Indicators of Compromise

HTTP POST requests to endpoints invoking formWriteFacMac that contain shell metacharacters such as ;, &&, |, or backticks in the mac parameter
Unexpected outbound connections from the router to attacker-controlled hosts following administrative requests
New or modified iptables rules, DNS configuration, or crontab entries on the device
Presence of unfamiliar processes or binaries in device memory or persistent storage

Detection Strategies

Inspect HTTP traffic to router management interfaces for mac parameter values that do not conform to a valid MAC address format
Alert on any administrative HTTP request whose parameters contain shell control characters
Correlate router configuration changes with the HTTP requests that preceded them

Monitoring Recommendations

Forward router syslog and HTTP access logs to a centralized log platform for continuous inspection
Monitor for anomalous DNS resolvers, static routes, or firmware modifications on Tenda devices
Baseline expected traffic to and from the router management IP and alert on deviations

How to Mitigate CVE-2024-30637

Immediate Actions Required

Restrict access to the router web management interface to trusted management VLANs or hosts only
Disable remote management on the WAN interface if it is enabled
Change default administrator credentials and rotate any credentials that may have been exposed
Isolate affected Tenda F1202 devices from sensitive network segments until a fix is available

Patch Information

No vendor advisory or firmware update from Tenda is referenced in the NVD entry for CVE-2024-30637 at the time of publication. Administrators should monitor the Tenda support portal for firmware releases addressing the formWriteFacMac command injection and apply updates as soon as they become available.

Workarounds

Place the router behind a segmented management network that blocks untrusted clients from reaching the HTTP administration service
Enforce Wi-Fi client isolation and disable guest access to prevent adjacent-network attackers from reaching the management interface
Consider replacing the device with a supported model if the vendor does not release a firmware fix

bash

# Example: restrict router management interface access to a single admin host
# Applied on an upstream firewall or L3 switch
iptables -A FORWARD -s 192.0.2.10/32 -d 192.168.0.1 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -d 192.168.0.1 -p tcp --dport 80 -j DROP