Sign-up

ID

VAR-202408-0606


CVE

CVE-2024-42987


TITLE

Shenzhen Tenda Technology Co.,Ltd.  of  fh1206  Out-of-bounds write vulnerability in firmware

Trust: 0.8

sources: JVNDB: JVNDB-2024-005622

DESCRIPTION

Tenda FH1206 v02.03.01.35 was discovered to contain a stack-based buffer overflow vulnerability in the fromPptpUserAdd function. The vulnerability can be triggered via the modino, username, newpwd, or pptpdnetseg parameters, all of which are passed via HTTP POST and used in unsafe sprintf calls without proper length validation. A remote attacker can exploit this flaw through a crafted POST request, which may cause a Denial of Service (DoS). In certain scenarios, this issue could potentially be leveraged to achieve remote code execution. Shenzhen Tenda Technology Co.,Ltd. of fh1206 An out-of-bounds write vulnerability exists in firmware.Service operation interruption (DoS) It may be in a state. Tenda FH1206 is a dual-band wireless router launched by Tenda, designed for large fiber-optic households

Trust: 2.16

sources: NVD: CVE-2024-42987 // JVNDB: JVNDB-2024-005622 // CNVD: CNVD-2025-16092

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2025-16092

AFFECTED PRODUCTS

vendor:tendamodel:fh1206scope:eqversion:v02.03.1.35

Trust: 1.0

vendor:tendamodel:fh1206scope: - version: -

Trust: 0.8

vendor:tendamodel:fh1206scope:eqversion: -

Trust: 0.8

vendor:tendamodel:fh1206scope:eqversion:fh1206 firmware v02.03.1.35

Trust: 0.8

vendor:tendamodel:fh1206scope:eqversion:02.03.01.35

Trust: 0.6

sources: CNVD: CNVD-2025-16092 // JVNDB: JVNDB-2024-005622 // NVD: CVE-2024-42987

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2024-42987
value: HIGH

Trust: 1.0

134c704f-9b21-4f2e-91b3-4a467353bcc0: CVE-2024-42987
value: HIGH

Trust: 1.0

NVD: CVE-2024-42987
value: HIGH

Trust: 0.8

CNVD: CNVD-2025-16092
value: HIGH

Trust: 0.6

CNVD: CNVD-2025-16092
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2024-42987
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.1

Trust: 2.0

NVD: CVE-2024-42987
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2025-16092 // JVNDB: JVNDB-2024-005622 // NVD: CVE-2024-42987 // NVD: CVE-2024-42987

PROBLEMTYPE DATA

problemtype:CWE-787

Trust: 1.0

problemtype:Out-of-bounds writing (CWE-787) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2024-005622 // NVD: CVE-2024-42987

PATCH

title:Patch for Tenda FH1206 Buffer Overflow Vulnerability (CNVD-2025-16092)url:https://www.cnvd.org.cn/patchInfo/show/709851

Trust: 0.6

sources: CNVD: CNVD-2025-16092

EXTERNAL IDS

db:NVDid:CVE-2024-42987

Trust: 3.2

db:JVNDBid:JVNDB-2024-005622

Trust: 0.8

db:CNVDid:CNVD-2025-16092

Trust: 0.6

sources: CNVD: CNVD-2025-16092 // JVNDB: JVNDB-2024-005622 // NVD: CVE-2024-42987

REFERENCES

url:https://github.com/tttjjjwww/ahu-iot-vulnerable/blob/main/tenda/fh1206/frompptpuseradd.md

Trust: 1.8

url:https://nvd.nist.gov/vuln/detail/cve-2024-42987

Trust: 1.4

url:https://github.com/laohouzju/poc/blob/main/tenda%20fh1206%20frompptpuseradd_newpwd.md

Trust: 1.0

url:https://github.com/laohouzju/poc/blob/main/tenda%20fh1206%20frompptpuseradd_username.md

Trust: 1.0

url:https://github.com/laohouzju/poc/blob/main/tenda%20fh1206%20frompptpuseradd_pptpdnetseg.md

Trust: 1.0

sources: CNVD: CNVD-2025-16092 // JVNDB: JVNDB-2024-005622 // NVD: CVE-2024-42987

SOURCES

db:CNVDid:CNVD-2025-16092
db:JVNDBid:JVNDB-2024-005622
db:NVDid:CVE-2024-42987

LAST UPDATE DATE

2025-09-06T00:04:20.004000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2025-16092date:2025-07-16T00:00:00
db:JVNDBid:JVNDB-2024-005622date:2024-08-19T02:06:00
db:NVDid:CVE-2024-42987date:2025-09-02T17:15:34.390

SOURCES RELEASE DATE

db:CNVDid:CNVD-2025-16092date:2025-07-16T00:00:00
db:JVNDBid:JVNDB-2024-005622date:2024-08-19T00:00:00
db:NVDid:CVE-2024-42987date:2024-08-15T17:15:21.820