Details of VAR-202403-2634

ID

VAR-202403-2634

CVE

CVE-2024-30592

TITLE

Shenzhen Tenda Technology Co.,Ltd. of FH1202 Stack-based buffer overflow vulnerability in firmware

Trust: 0.8

sources: JVNDB: JVNDB-2024-020419

DESCRIPTION

Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the page parameter of the fromAddressNat function. Shenzhen Tenda Technology Co.,Ltd. of FH1202 A stack-based buffer overflow vulnerability exists in the firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. The vulnerability is caused by the page parameter of the fromAddressNat method failing to properly verify the length of the input data. Attackers can exploit this vulnerability to execute arbitrary code on the system or cause a denial of service

Trust: 2.16

sources: NVD: CVE-2024-30592 // JVNDB: JVNDB-2024-020419 // CNVD: CNVD-2024-36921

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2024-36921

AFFECTED PRODUCTS

vendor:	tenda	model:	fh1202	scope:	eq	version:	1.2.0.14\(408\)	Trust: 1.0
vendor:	tenda	model:	fh1202	scope:	eq	version:	-	Trust: 0.8
vendor:	tenda	model:	fh1202	scope:	-	version:	-	Trust: 0.8
vendor:	tenda	model:	fh1202	scope:	eq	version:	fh1202 firmware 1.2.0.14(408)	Trust: 0.8
vendor:	tenda	model:	fh1202	scope:	eq	version:	v1.2.0.14(408)	Trust: 0.6

sources: CNVD: CNVD-2024-36921 // JVNDB: JVNDB-2024-020419 // NVD: CVE-2024-30592

CVSS

SEVERITY

CVSSV2

CVSSV3

134c704f-9b21-4f2e-91b3-4a467353bcc0:	CVE-2024-30592
value:	HIGH
Trust: 1.0
OTHER:	JVNDB-2024-020419
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2024-36921
value:	HIGH
Trust: 0.6

CNVD:	CNVD-2024-36921
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

134c704f-9b21-4f2e-91b3-4a467353bcc0:	CVE-2024-30592
baseSeverity:	HIGH
baseScore:	8.0
vectorString:	CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	ADJACENT
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.1
impactScore:	5.9
version:	3.1
Trust: 1.0
OTHER:	JVNDB-2024-020419
baseSeverity:	HIGH
baseScore:	8.0
vectorString:	CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	ADJACENT NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2024-36921 // JVNDB: JVNDB-2024-020419 // NVD: CVE-2024-30592

PROBLEMTYPE DATA

problemtype:	CWE-121	Trust: 1.0
problemtype:	Stack-based buffer overflow (CWE-121) [ others ]	Trust: 0.8

sources: JVNDB: JVNDB-2024-020419 // NVD: CVE-2024-30592

PATCH

title:

Patch for Tenda FH1202 page parameter buffer overflow vulnerability

url:

https://www.cnvd.org.cn/patchInfo/show/585416

Trust: 0.6

sources: CNVD: CNVD-2024-36921

EXTERNAL IDS

db:	NVD	id:	CVE-2024-30592	Trust: 3.2
db:	JVNDB	id:	JVNDB-2024-020419	Trust: 0.8
db:	CNVD	id:	CNVD-2024-36921	Trust: 0.6

sources: CNVD: CNVD-2024-36921 // JVNDB: JVNDB-2024-020419 // NVD: CVE-2024-30592

REFERENCES

url:	https://nvd.nist.gov/vuln/detail/cve-2024-30592	Trust: 1.4
url:	https://github.com/abcdefg-png/iot-vulnerable/blob/main/tenda/fh/fh1202/fromaddressnat_page.md	Trust: 1.0

sources: CNVD: CNVD-2024-36921 // JVNDB: JVNDB-2024-020419 // NVD: CVE-2024-30592

SOURCES

db:	CNVD	id:	CNVD-2024-36921
db:	JVNDB	id:	JVNDB-2024-020419
db:	NVD	id:	CVE-2024-30592

LAST UPDATE DATE

2025-03-15T23:24:47.340000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2024-36921	date:	2024-08-30T00:00:00
db:	JVNDB	id:	JVNDB-2024-020419	date:	2025-03-14T01:38:00
db:	NVD	id:	CVE-2024-30592	date:	2025-03-13T17:42:03.610

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2024-36921	date:	2024-08-30T00:00:00
db:	JVNDB	id:	JVNDB-2024-020419	date:	2025-03-14T00:00:00
db:	NVD	id:	CVE-2024-30592	date:	2024-03-28T14:15:15.437