Sign-up

ID

VAR-202404-0244


CVE

CVE-2024-4020


TITLE

Shenzhen Tenda Technology Co.,Ltd.  of  fh1206  Out-of-bounds write vulnerability in firmware

Trust: 0.8

sources: JVNDB: JVNDB-2024-019939

DESCRIPTION

A vulnerability was found in Tenda FH1206 1.2.0.8(8155) and classified as critical. This issue affects the function fromAddressNat of the file /goform/addressNat. The manipulation of the argument entrys leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-261671. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Shenzhen Tenda Technology Co.,Ltd. of fh1206 An out-of-bounds write vulnerability exists in firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. No detailed vulnerability details are provided at present

Trust: 2.16

sources: NVD: CVE-2024-4020 // JVNDB: JVNDB-2024-019939 // CNVD: CNVD-2024-24958

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2024-24958

AFFECTED PRODUCTS

vendor:tendamodel:fh1206scope:eqversion:1.2.0.8\(8155\)

Trust: 1.0

vendor:tendamodel:fh1206scope: - version: -

Trust: 0.8

vendor:tendamodel:fh1206scope:eqversion:fh1206 firmware 1.2.0.8(8155)

Trust: 0.8

vendor:tendamodel:fh1206scope:eqversion: -

Trust: 0.8

vendor:tendamodel:fh1206scope:eqversion:1.2.0.8(8155)

Trust: 0.6

sources: CNVD: CNVD-2024-24958 // JVNDB: JVNDB-2024-019939 // NVD: CVE-2024-4020

CVSS

SEVERITY

CVSSV2

CVSSV3

cna@vuldb.com: CVE-2024-4020
value: HIGH

Trust: 1.0

nvd@nist.gov: CVE-2024-4020
value: HIGH

Trust: 1.0

OTHER: JVNDB-2024-019939
value: HIGH

Trust: 0.8

CNVD: CNVD-2024-24958
value: HIGH

Trust: 0.6

cna@vuldb.com: CVE-2024-4020
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

OTHER: JVNDB-2024-019939
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

CNVD: CNVD-2024-24958
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

cna@vuldb.com: CVE-2024-4020
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 2.0

NVD: JVNDB-2024-019939
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2024-24958 // JVNDB: JVNDB-2024-019939 // NVD: CVE-2024-4020 // NVD: CVE-2024-4020

PROBLEMTYPE DATA

problemtype:CWE-787

Trust: 1.0

problemtype:CWE-120

Trust: 1.0

problemtype:Classic buffer overflow (CWE-120) [ others ]

Trust: 0.8

problemtype: Out-of-bounds writing (CWE-787) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2024-019939 // NVD: CVE-2024-4020

EXTERNAL IDS

db:NVDid:CVE-2024-4020

Trust: 3.2

db:VULDBid:261671

Trust: 1.0

db:JVNDBid:JVNDB-2024-019939

Trust: 0.8

db:CNVDid:CNVD-2024-24958

Trust: 0.6

sources: CNVD: CNVD-2024-24958 // JVNDB: JVNDB-2024-019939 // NVD: CVE-2024-4020

REFERENCES

url:https://palm-vertebra-fe9.notion.site/fromaddressnat_entrys-b04d5356e5f04e30b37cb9037b94e1b2

Trust: 1.8

url:https://vuldb.com/?submit.316036

Trust: 1.8

url:https://vuldb.com/?id.261671

Trust: 1.0

url:https://vuldb.com/?ctiid.261671

Trust: 1.0

url:https://nvd.nist.gov/vuln/detail/cve-2024-4020

Trust: 0.8

url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2024-4020

Trust: 0.6

sources: CNVD: CNVD-2024-24958 // JVNDB: JVNDB-2024-019939 // NVD: CVE-2024-4020

SOURCES

db:CNVDid:CNVD-2024-24958
db:JVNDBid:JVNDB-2024-019939
db:NVDid:CVE-2024-4020

LAST UPDATE DATE

2025-03-08T23:38:19.531000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2024-24958date:2024-05-30T00:00:00
db:JVNDBid:JVNDB-2024-019939date:2025-03-07T03:19:00
db:NVDid:CVE-2024-4020date:2025-03-06T15:00:11.560

SOURCES RELEASE DATE

db:CNVDid:CNVD-2024-24958date:2024-05-29T00:00:00
db:JVNDBid:JVNDB-2024-019939date:2025-03-07T00:00:00
db:NVDid:CVE-2024-4020date:2024-04-20T23:15:48.183