CVE-2024-2982

Tenda FH1202 WriteFacMac formWriteFacMac command injection

A vulnerability has been found in Tenda FH1202 1.2.0.14(408) and classified as critical. Affected by this vulnerability is the function formWriteFacMac of the file /goform/WriteFacMac. The manipulation of the argument mac leads to command injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258151. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. In Tenda FH1202 1.2.0.14(408) wurde eine Schwachstelle gefunden. Sie wurde als kritisch eingestuft. Das betrifft die Funktion formWriteFacMac der Datei /goform/WriteFacMac. Durch die Manipulation des Arguments mac mit unbekannten Daten kann eine command injection-Schwachstelle ausgenutzt werden. Der Exploit steht zur öffentlichen Verfügung.

Affected

Tenda · FH1202

CVSS v3.1 NVD

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 VULDB

5.5 MEDIUMCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CVSS v2.0 VULDB

5.2 MEDIUMAV:A/AC:L/Au:S/C:P/I:P/A:P

EPSS

8.16% chance of exploitation in the next 30 days, 95th percentile

Published

2024-03-27

Updated

2024-08-12

Proof-of-concept exploits (1)

• abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1202/formWriteFacMac.md70★ · 2026-08-21

Security advisories

• https://vuldb.com/?ctiid.258151
• https://vuldb.com/?id.258151
• https://vuldb.com/?submit.301273

References

• CVE Record
• NVD entry