CVE-2024-2982: Tenda FH1202 WriteFacMac formWriteFacMac command injection

Published Mar 27, 2024

Updated

A vulnerability has been found in Tenda FH1202 1.2.0.14(408) and classified as critical. Affected by this vulnerability is the function formWriteFacMac of the file /goform/WriteFacMac. The manipulation of the argument mac leads to command injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258151. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

2 affected components

All of the following

Tenda Fh1202 Firmware=1.2.0.14\(408\)

Tenda FH1202

Event History

Mar 27, 2024

CVE Published

via MITRE·03:31 PM

Data Sourced

via MITRE·03:31 PM

DescriptionSeverityWeakness

Jun 30, 57009

Event

via NVD·08:55 PM

Frequently Asked Questions

What is the severity of CVE-2024-2982?

CVE-2024-2982 is classified as a critical severity vulnerability.

What systems are affected by CVE-2024-2982?

CVE-2024-2982 affects Tenda FH1202 firmware version 1.2.0.14(408).

How does CVE-2024-2982 impact affected systems?

CVE-2024-2982 allows for command injection via the formWriteFacMac function due to improper handling of the 'mac' argument.

How can I fix CVE-2024-2982?

To fix CVE-2024-2982, it is recommended to update to a patched firmware version provided by Tenda.

Is CVE-2024-2982 exploitable remotely?

Yes, CVE-2024-2982 is potentially exploitable remotely through the affected firmware interface.