ID
VAR-202403-0979
CVE
CVE-2024-2993
TITLE
Shenzhen Tenda Technology Co.,Ltd. of fh1203 Out-of-bounds write vulnerability in firmware
Trust: 0.8
DESCRIPTION
A vulnerability was found in Tenda FH1203 2.0.1.6. It has been classified as critical. Affected is the function formQuickIndex of the file /goform/QuickIndex. The manipulation of the argument PPPOEPassword leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-258162 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. of fh1203 An out-of-bounds write vulnerability exists in firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. The Tenda FH1203 is a dual-band wireless router released by China's Tenda Group, primarily used for home network coverage. This vulnerability stems from the failure to properly validate the length of the input data in the PPPOEPassword parameter of the formQuickIndex method in the /goform/QuickIndex file. An attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service
Trust: 2.16
IOT TAXONOMY
| category: | ['Network device'] | sub_category: | - | Trust: 0.6 |
AFFECTED PRODUCTS
| vendor: | tenda | model: | fh1203 | scope: | eq | version: | 2.0.1.6 | Trust: 1.6 |
| vendor: | tenda | model: | fh1203 | scope: | eq | version: | - | Trust: 0.8 |
| vendor: | tenda | model: | fh1203 | scope: | eq | version: | fh1203 firmware 2.0.1.6 | Trust: 0.8 |
| vendor: | tenda | model: | fh1203 | scope: | - | version: | - | Trust: 0.8 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-121 | Trust: 1.0 |
| problemtype: | CWE-787 | Trust: 1.0 |
| problemtype: | Stack-based buffer overflow (CWE-121) [ others ] | Trust: 0.8 |
| problemtype: | Out-of-bounds writing (CWE-787) [NVD evaluation ] | Trust: 0.8 |
PATCH
| title: | Patch for Tenda FH1203 formQuickIndex method buffer overflow vulnerability | url: | https://www.cnvd.org.cn/patchInfo/show/713236 | Trust: 0.6 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2024-2993 | Trust: 3.2 |
| db: | VULDB | id: | 258162 | Trust: 1.8 |
| db: | JVNDB | id: | JVNDB-2024-016806 | Trust: 0.8 |
| db: | CNVD | id: | CNVD-2025-17052 | Trust: 0.6 |
REFERENCES
| url: | https://github.com/abcdefg-png/iot-vulnerable/blob/main/tenda/fh/fh1203/formquickindex.md | Trust: 1.8 |
| url: | https://vuldb.com/?id.258162 | Trust: 1.8 |
| url: | https://vuldb.com/?submit.301372 | Trust: 1.8 |
| url: | https://vuldb.com/?ctiid.258162 | Trust: 1.0 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2024-2993 | Trust: 0.8 |
| url: | https://patchstack.com/database/vulnerability/sina-extension-for-elementor/wordpress-sina-extension-for-elementor-plugin-3-5-0-cross-site-scripting-xss-vulnerability?_s_id=cve | Trust: 0.6 |
SOURCES
| db: | CNVD | id: | CNVD-2025-17052 |
| db: | JVNDB | id: | JVNDB-2024-016806 |
| db: | NVD | id: | CVE-2024-2993 |
LAST UPDATE DATE
2025-07-30T23:00:30.098000+00:00
SOURCES UPDATE DATE
| db: | CNVD | id: | CNVD-2025-17052 | date: | 2025-07-29T00:00:00 |
| db: | JVNDB | id: | JVNDB-2024-016806 | date: | 2025-01-17T09:25:00 |
| db: | NVD | id: | CVE-2024-2993 | date: | 2025-01-15T18:21:04.553 |
SOURCES RELEASE DATE
| db: | CNVD | id: | CNVD-2025-17052 | date: | 2025-07-29T00:00:00 |
| db: | JVNDB | id: | JVNDB-2024-016806 | date: | 2025-01-17T00:00:00 |
| db: | NVD | id: | CVE-2024-2993 | date: | 2024-03-27T20:15:08.780 |