High severity · published Mar 27, 2024
CVE-2024-2978
Tenda F1203 setcfm formSetCfm stack-based overflow
8.8
CVSS
1.8%
EPSS
No
On KEV
Description
A vulnerability classified as critical has been found in Tenda F1203 2.0.1.6. This affects the function formSetCfm of the file /goform/setcfm. The manipulation of the argument funcpara1 leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258147. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
F1
F1203 · Tenda
2.0.1.6 · source: vendor, CISA
FF
F1203 Firmware · Tenda
2.0.1.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-2978
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-2978
Exploit
https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/F/F1203/formSetCfm.md
Permissions Required
https://vuldb.com/?ctiid.258147
Third Party Advisory
https://vuldb.com/?id.258147
Third Party Advisory
https://vuldb.com/?submit.301029
More from F1203
9.8
CVE-2023-38931
Tenda AC10 V1.0 V15.03.06.23, AC1206 V15.03.06.23, AC8 v4 V16.03.34.06, AC6 V2.0 V15.03.06.23, AC7 V1.0 V15.03.06.44, F1203 V2.0.1.6, AC5 V1.0 V15.03.06.28, AC10 v4.0 V16.03.10.13…
9.8
CVE-2023-38933
Tenda AC6 V2.0 V15.03.06.23, AC7 V1.0 V15.03.06.44, F1203 V2.0.1.6, AC5 V1.0 V15.03.06.28, FH1203 V2.0.1.6 and AC9 V3.0 V15.03.06.42_multi, and FH1205 V2.0.0.7(775) were…
9.8
CVE-2023-38934
Tenda F1203 V2.0.1.6, FH1203 V2.0.1.6 and FH1205 V2.0.0.7(775) was discovered to contain a stack overflow via the deviceId parameter in the formSetDeviceName function
9.8
CVE-2023-38940
Tenda F1203 V2.0.1.6, FH1203 V2.0.1.6 and FH1205 V2.0.0.7(775) were discovered to contain a stack overflow via the ssid parameter in the form_fast_setting_wifi_set function
8.8
CVE-2024-2979
Tenda F1203 openSchedWifi setSchedWifi stack-based overflow