Sign-up

ID

VAR-202403-2070


CVE

CVE-2024-30596


TITLE

Tenda FH1202 deviceId parameter buffer overflow vulnerability (CNVD-2024-36919)

Trust: 0.6

sources: CNVD: CNVD-2024-36919

DESCRIPTION

Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the deviceId parameter of the formSetDeviceName function. Tenda FH1202 is a wireless router from China's Tenda company. The vulnerability is caused by the deviceId parameter of the formSetDeviceName method failing to properly validate the length of the input data. Attackers can exploit this vulnerability to execute arbitrary code on the system or cause a denial of service

Trust: 1.44

sources: NVD: CVE-2024-30596 // CNVD: CNVD-2024-36919

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2024-36919

AFFECTED PRODUCTS

vendor:tendamodel:fh1202scope:eqversion:v1.2.0.14(408)

Trust: 0.6

sources: CNVD: CNVD-2024-36919

CVSS

SEVERITY

CVSSV2

CVSSV3

134c704f-9b21-4f2e-91b3-4a467353bcc0: CVE-2024-30596
value: CRITICAL

Trust: 1.0

CNVD: CNVD-2024-36919
value: HIGH

Trust: 0.6

CNVD: CNVD-2024-36919
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

134c704f-9b21-4f2e-91b3-4a467353bcc0: CVE-2024-30596
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.1

Trust: 1.0

sources: CNVD: CNVD-2024-36919 // NVD: CVE-2024-30596

PROBLEMTYPE DATA

problemtype:CWE-125

Trust: 1.0

sources: NVD: CVE-2024-30596

PATCH

title:Patch for Tenda FH1202 deviceId parameter buffer overflow vulnerability (CNVD-2024-36919)url:https://www.cnvd.org.cn/patchInfo/show/585406

Trust: 0.6

sources: CNVD: CNVD-2024-36919

EXTERNAL IDS

db:NVDid:CVE-2024-30596

Trust: 1.6

db:CNVDid:CNVD-2024-36919

Trust: 0.6

sources: CNVD: CNVD-2024-36919 // NVD: CVE-2024-30596

REFERENCES

url:https://github.com/abcdefg-png/iot-vulnerable/blob/main/tenda/fh/fh1202/formsetdevicename_deviceid.md

Trust: 1.0

url:https://nvd.nist.gov/vuln/detail/cve-2024-30596

Trust: 0.6

sources: CNVD: CNVD-2024-36919 // NVD: CVE-2024-30596

SOURCES

db:CNVDid:CNVD-2024-36919
db:NVDid:CVE-2024-30596

LAST UPDATE DATE

2024-10-29T23:33:33.841000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2024-36919date:2024-08-30T00:00:00
db:NVDid:CVE-2024-30596date:2024-10-28T16:35:06.740

SOURCES RELEASE DATE

db:CNVDid:CNVD-2024-36919date:2024-08-30T00:00:00
db:NVDid:CVE-2024-30596date:2024-03-28T13:15:48.063