Details of VAR-202403-2071

ID

VAR-202403-2071

CVE

CVE-2024-30594

TITLE

Shenzhen Tenda Technology Co.,Ltd. of FH1202 Stack-based buffer overflow vulnerability in firmware

Trust: 0.8

sources: JVNDB: JVNDB-2024-020484

DESCRIPTION

Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the deviceMac parameter of the addWifiMacFilter function. Shenzhen Tenda Technology Co.,Ltd. of FH1202 A stack-based buffer overflow vulnerability exists in the firmware.Service operation interruption (DoS) It may be in a state. The vulnerability is caused by the deviceMac parameter of the addWifiMacFilter method failing to properly verify the length of the input data. Attackers can exploit this vulnerability to execute arbitrary code on the system or cause a denial of service

Trust: 2.16

sources: NVD: CVE-2024-30594 // JVNDB: JVNDB-2024-020484 // CNVD: CNVD-2024-36918

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2024-36918

AFFECTED PRODUCTS

vendor:	tenda	model:	fh1202	scope:	eq	version:	1.2.0.14\(408\)	Trust: 1.0
vendor:	tenda	model:	fh1202	scope:	eq	version:	-	Trust: 0.8
vendor:	tenda	model:	fh1202	scope:	-	version:	-	Trust: 0.8
vendor:	tenda	model:	fh1202	scope:	eq	version:	fh1202 firmware 1.2.0.14(408)	Trust: 0.8
vendor:	tenda	model:	fh1202	scope:	eq	version:	v1.2.0.14(408)	Trust: 0.6

sources: CNVD: CNVD-2024-36918 // JVNDB: JVNDB-2024-020484 // NVD: CVE-2024-30594

CVSS

SEVERITY

CVSSV2

CVSSV3

134c704f-9b21-4f2e-91b3-4a467353bcc0:	CVE-2024-30594
value:	MEDIUM
Trust: 1.0
OTHER:	JVNDB-2024-020484
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2024-36918
value:	HIGH
Trust: 0.6

CNVD:	CNVD-2024-36918
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

134c704f-9b21-4f2e-91b3-4a467353bcc0:	CVE-2024-30594
baseSeverity:	MEDIUM
baseScore:	6.5
vectorString:	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector:	ADJACENT
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	2.8
impactScore:	3.6
version:	3.1
Trust: 1.0
OTHER:	JVNDB-2024-020484
baseSeverity:	MEDIUM
baseScore:	6.5
vectorString:	CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector:	ADJACENT NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2024-36918 // JVNDB: JVNDB-2024-020484 // NVD: CVE-2024-30594

PROBLEMTYPE DATA

problemtype:	CWE-121	Trust: 1.0
problemtype:	Stack-based buffer overflow (CWE-121) [ others ]	Trust: 0.8

sources: JVNDB: JVNDB-2024-020484 // NVD: CVE-2024-30594

PATCH

title:

Patch for Tenda FH1202 deviceMac parameter buffer overflow vulnerability

url:

https://www.cnvd.org.cn/patchInfo/show/585401

Trust: 0.6

sources: CNVD: CNVD-2024-36918

EXTERNAL IDS

db:	NVD	id:	CVE-2024-30594	Trust: 3.2
db:	JVNDB	id:	JVNDB-2024-020484	Trust: 0.8
db:	CNVD	id:	CNVD-2024-36918	Trust: 0.6

sources: CNVD: CNVD-2024-36918 // JVNDB: JVNDB-2024-020484 // NVD: CVE-2024-30594

REFERENCES

url:	https://nvd.nist.gov/vuln/detail/cve-2024-30594	Trust: 1.4
url:	https://github.com/abcdefg-png/iot-vulnerable/blob/main/tenda/fh/fh1202/addwifimacfilter_devicemac.md	Trust: 1.0

sources: CNVD: CNVD-2024-36918 // JVNDB: JVNDB-2024-020484 // NVD: CVE-2024-30594

SOURCES

db:	CNVD	id:	CNVD-2024-36918
db:	JVNDB	id:	JVNDB-2024-020484
db:	NVD	id:	CVE-2024-30594

LAST UPDATE DATE

2025-03-15T23:19:00.956000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2024-36918	date:	2024-08-30T00:00:00
db:	JVNDB	id:	JVNDB-2024-020484	date:	2025-03-14T06:15:00
db:	NVD	id:	CVE-2024-30594	date:	2025-03-13T17:40:47.520

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2024-36918	date:	2024-08-30T00:00:00
db:	JVNDB	id:	JVNDB-2024-020484	date:	2025-03-14T00:00:00
db:	NVD	id:	CVE-2024-30594	date:	2024-03-28T13:15:48.007