CVE-2024-2981

🗓️ 27 Mar 2024 15:00:07Reported by VulDBType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 46 Views🌐 WEB

A critical stack-based buffer overflow vulnerability in Tenda FH1202 1.2.0.14(408) allows remote attackers to execute arbitrary code via manipulated ssid in /goform/fast_setting_wifi_set function

Reporter	Title	Published	Views	Family All 8
CNNVD	Tenda FH1202 安全漏洞	27 Mar 202400:00	–	cnnvd
CNVD	Tenda FH1202 form_fast_setting_wifi_set method buffer overflow vulnerability	29 Mar 202400:00	–	cnvd
Cvelist	CVE-2024-2981 Tenda FH1202 fast_setting_wifi_set form_fast_setting_wifi_set stack-based overflow	27 Mar 202415:00	–	cvelist
EUVD	EUVD-2024-27921	3 Oct 202520:07	–	euvd
NVD	CVE-2024-2981	27 Mar 202415:15	–	nvd
Positive Technologies	PT-2024-23055 · Tenda · Tenda Fh1202	27 Mar 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-2981	7 Jan 202609:08	–	redhatcve
Vulnrichment	CVE-2024-2981 Tenda FH1202 fast_setting_wifi_set form_fast_setting_wifi_set stack-based overflow	27 Mar 202415:00	–	vulnrichment

NVD

Node

tenda fh1202_firmwareMatch1.2.0.14(408)

AND

tenda fh1202Match-

[
  {
    "vendor": "Tenda",
    "product": "FH1202",
    "versions": [
      {
        "version": "1.2.0.14(408)",
        "status": "affected"
      }
    ]
  }
]

Source	Link
vuldb	www.vuldb.com/
vuldb	www.vuldb.com/
github	www.github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1202/form_fast_setting_wifi_set.md
vuldb	www.vuldb.com/

Parameter	Position	Path	Description	CWE
ssid	request body	/goform/fast_setting_wifi_set	Manipulation of the ssid argument in the fast_setting_wifi_set endpoint leads to a stack-based buffer overflow, enabling remote code execution.	CWE-787, CWE-121

14 Jan 2025 15:33Current

8.9High risk

Vulners AI Score8.9

CVSS 3.18.8

CVSS 29

CVSS 38.8

EPSS0.00489

SSVC