Details of VAR-202404-0442

ID

VAR-202404-0442

CVE

CVE-2024-32310

TITLE

Shenzhen Tenda Technology Co.,Ltd. of f1203 Stack-based buffer overflow vulnerability in firmware

Trust: 0.8

sources: JVNDB: JVNDB-2024-020567

DESCRIPTION

Tenda F1203 V2.0.1.6 firmware has a stack overflow vulnerability located in the PPW parameter of the fromWizardHandle function. Shenzhen Tenda Technology Co.,Ltd. of f1203 A stack-based buffer overflow vulnerability exists in the firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. in January 2015. The vulnerability is caused by the PPW parameter of the fromWizardHandle method failing to correctly verify the length of the input data. Attackers can exploit this vulnerability to execute arbitrary code on the system or cause a denial of service

Trust: 2.16

sources: NVD: CVE-2024-32310 // JVNDB: JVNDB-2024-020567 // CNVD: CNVD-2025-16338

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2025-16338

AFFECTED PRODUCTS

vendor:	tenda	model:	f1203	scope:	eq	version:	2.0.1.6	Trust: 1.6
vendor:	tenda	model:	f1203	scope:	eq	version:	f1203 firmware 2.0.1.6	Trust: 0.8
vendor:	tenda	model:	f1203	scope:	-	version:	-	Trust: 0.8
vendor:	tenda	model:	f1203	scope:	eq	version:	-	Trust: 0.8

sources: CNVD: CNVD-2025-16338 // JVNDB: JVNDB-2024-020567 // NVD: CVE-2024-32310

CVSS

SEVERITY

CVSSV2

CVSSV3

134c704f-9b21-4f2e-91b3-4a467353bcc0:	CVE-2024-32310
value:	HIGH
Trust: 1.0
OTHER:	JVNDB-2024-020567
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2025-16338
value:	HIGH
Trust: 0.6

CNVD:	CNVD-2025-16338
severity:	HIGH
baseScore:	7.7
vectorString:	AV:A/AC:L/AU:S/C:C/I:C/A:C
accessVector:	ADJACENT_NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	5.1
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

134c704f-9b21-4f2e-91b3-4a467353bcc0:	CVE-2024-32310
baseSeverity:	HIGH
baseScore:	8.0
vectorString:	CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	ADJACENT
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.1
impactScore:	5.9
version:	3.1
Trust: 1.0
OTHER:	JVNDB-2024-020567
baseSeverity:	HIGH
baseScore:	8.0
vectorString:	CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	ADJACENT NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2025-16338 // JVNDB: JVNDB-2024-020567 // NVD: CVE-2024-32310

PROBLEMTYPE DATA

problemtype:	CWE-121	Trust: 1.0
problemtype:	Stack-based buffer overflow (CWE-121) [ others ]	Trust: 0.8

sources: JVNDB: JVNDB-2024-020567 // NVD: CVE-2024-32310

PATCH

title:

Patch for Tenda F1203 fromWizardHandle method buffer overflow vulnerability

url:

https://www.cnvd.org.cn/patchInfo/show/710446

Trust: 0.6

sources: CNVD: CNVD-2025-16338

EXTERNAL IDS

db:	NVD	id:	CVE-2024-32310	Trust: 3.2
db:	JVNDB	id:	JVNDB-2024-020567	Trust: 0.8
db:	CNVD	id:	CNVD-2025-16338	Trust: 0.6

sources: CNVD: CNVD-2025-16338 // JVNDB: JVNDB-2024-020567 // NVD: CVE-2024-32310

REFERENCES

url:	https://github.com/abcdefg-png/iot-vulnerable/blob/main/tenda/f/f1203/fromwizardhandle.md	Trust: 1.6
url:	https://nvd.nist.gov/vuln/detail/cve-2024-32310	Trust: 0.8

sources: CNVD: CNVD-2025-16338 // JVNDB: JVNDB-2024-020567 // NVD: CVE-2024-32310

SOURCES

db:	CNVD	id:	CNVD-2025-16338
db:	JVNDB	id:	JVNDB-2024-020567
db:	NVD	id:	CVE-2024-32310

LAST UPDATE DATE

2025-07-20T23:10:05.062000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2025-16338	date:	2025-07-18T00:00:00
db:	JVNDB	id:	JVNDB-2024-020567	date:	2025-03-19T01:19:00
db:	NVD	id:	CVE-2024-32310	date:	2025-03-17T14:56:06.887

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2025-16338	date:	2025-07-18T00:00:00
db:	JVNDB	id:	JVNDB-2024-020567	date:	2025-03-19T00:00:00
db:	NVD	id:	CVE-2024-32310	date:	2024-04-17T13:15:08.390