CVE-2024-32307: Tenda FH1205 Buffer Overflow Vulnerability

CVE-2024-32307 Overview

CVE-2024-32307 is a stack-based buffer overflow [CWE-121] in the Tenda FH1205 wireless router running firmware version V2.0.0.7(775). The flaw resides in the fromWizardHandle function, which fails to validate the length of the PPW parameter before copying it into a fixed-size stack buffer. A remote attacker can send a crafted HTTP request to trigger memory corruption on the device. Successful exploitation can crash the router or alter program control flow, threatening confidentiality and integrity of network traffic passing through the device.

Critical Impact

Remote attackers can corrupt stack memory on the Tenda FH1205 router through the PPW parameter, potentially hijacking execution flow and disrupting network availability.

Affected Products

• Tenda FH1205 router (hardware)
• Tenda FH1205 firmware version V2.0.0.7(775)
• Web management interface exposing the fromWizardHandle endpoint

Discovery Timeline

• 2024-04-17 - CVE-2024-32307 published to NVD
• 2025-03-17 - Last updated in NVD database

Technical Details for CVE-2024-32307

Vulnerability Analysis

The vulnerability is a classic stack-based buffer overflow inside the fromWizardHandle handler of the Tenda FH1205 HTTP management service. The handler reads the PPW HTTP parameter from a client request and copies it into a stack-allocated buffer without enforcing a length check. When the attacker supplies a PPW value longer than the destination buffer, adjacent stack memory, including saved registers and the return address, is overwritten.

Tenda routers run on MIPS-based SoCs, where overwriting the saved return address allows redirection of control flow on function epilogue. Because the network stack on these devices typically lacks Address Space Layout Randomization (ASLR) and stack canaries, the path from memory corruption to code execution is short. The flaw is reachable before authentication on devices where the wizard endpoint is exposed during initial provisioning.

Root Cause

The root cause is missing input validation on the PPW request parameter prior to a length-unchecked string copy operation inside fromWizardHandle. The function trusts attacker-controlled data and does not enforce a maximum length matching the destination buffer size.

Attack Vector

The attack vector is network-based. An attacker with reachability to the router's HTTP management interface sends a crafted POST request to the wizard endpoint with an oversized PPW value. The high attack complexity reflects that exploitation requires reliable knowledge of the device memory layout to weaponize the overflow beyond denial of service.

No verified public exploit code is available for CVE-2024-32307. A technical write-up describing the vulnerable function and parameter is published in the GitHub Vulnerability Report.

Detection Methods for CVE-2024-32307

Indicators of Compromise

• HTTP POST requests to wizard-related endpoints containing abnormally long PPW parameter values
• Unexpected reboots, watchdog resets, or httpd process crashes on the Tenda FH1205
• Loss of management interface availability following inbound traffic from untrusted sources

Detection Strategies

• Inspect HTTP request bodies destined for the router's LAN management port and flag PPW values exceeding expected length (typically under 64 bytes)
• Deploy network IDS signatures that match the fromWizardHandle URI pattern combined with oversized form fields
• Correlate router reachability failures with preceding HTTP traffic from external or untrusted internal hosts

Monitoring Recommendations

• Forward router syslog and management interface access logs to a centralized log platform for retention and analysis
• Alert on repeated connection attempts to the HTTP management interface from unexpected source addresses
• Track firmware version inventory across deployed Tenda devices to identify systems still running V2.0.0.7(775)

How to Mitigate CVE-2024-32307

Immediate Actions Required

• Restrict access to the Tenda FH1205 web management interface to trusted management VLANs only and block WAN-side access
• Disable remote administration features if they are not required for operational use
• Audit the deployed firmware version and identify any FH1205 units running V2.0.0.7(775)

Patch Information

No vendor advisory or fixed firmware release has been published in the NVD record for CVE-2024-32307 at the time of writing. Operators should monitor the Tenda support portal for updated firmware addressing the fromWizardHandle overflow and apply it as soon as it becomes available.

Workarounds

• Place the router's management interface behind a firewall ACL that only permits administrator workstations
• Replace end-of-support Tenda FH1205 units with currently supported hardware where no patch is forthcoming
• Segment IoT and SOHO routers onto isolated network segments to reduce blast radius if the device is compromised

# Example firewall rule to restrict access to the router management interface
# Replace 192.0.2.10 with the trusted administrator host and 192.168.0.1 with the router IP
iptables -A FORWARD -p tcp -d 192.168.0.1 --dport 80  -s 192.0.2.10 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.168.0.1 --dport 443 -s 192.0.2.10 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.168.0.1 --dport 80  -j DROP
iptables -A FORWARD -p tcp -d 192.168.0.1 --dport 443 -j DROP