Tenda FH1202 1.2.0.14(408) /goform/WriteFacMac formWriteFacMac mac 权限升级

在Tenda FH1202 1.2.0.14(408) 中已发现分类为致命的漏洞。 受此漏洞影响的是功能formWriteFacMac文件：/goform/WriteFacMac。 手动调试的软件参数:mac不合法输入可导致 权限升级。 漏洞的CWE定义是 CWE-77。 此漏洞的脆弱性 2024-03-27所发布。 阅读公告的网址是github.com。 该漏洞被称作为CVE-2024-2982， 攻击只能在局域网内完成。 有技术细节可用。 此外还有一个漏洞可利用。 该漏洞利用已公开，可能会被利用。 当前漏洞利用的价值为美元大约是$0-$5k 。 根据MITRE ATT&CK，此问题部署的攻击技术是T1202。 它被宣布为proof-of-concept。 可以在github.com下载该漏洞利用。 我们估计的零日攻击价值约为$0-$5k。 该漏洞被披露后，此前未曾发表过可能的缓解措施。

字段2024-03-27 08時10分2024-05-05 16時30分2024-05-05 16時38分
vendorTendaTendaTenda
nameFH1202FH1202FH1202
version1.2.0.14(408)1.2.0.14(408)1.2.0.14(408)
file/goform/WriteFacMac/goform/WriteFacMac/goform/WriteFacMac
functionformWriteFacMacformWriteFacMacformWriteFacMac
argumentmacmacmac
cwe77 (权限升级)77 (权限升级)77 (权限升级)
risk222
cvss3_vuldb_acLLL
cvss3_vuldb_sUUU
cvss3_vuldb_cLLL
cvss3_vuldb_iLLL
cvss3_vuldb_aLLL
cvss3_vuldb_ePPP
cvss3_vuldb_rcRRR
urlhttps://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1202/formWriteFacMac.mdhttps://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1202/formWriteFacMac.mdhttps://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1202/formWriteFacMac.md
availability111
publicity111
urlhttps://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1202/formWriteFacMac.mdhttps://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1202/formWriteFacMac.mdhttps://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1202/formWriteFacMac.md
cveCVE-2024-2982CVE-2024-2982CVE-2024-2982
responsibleVulDBVulDBVulDB
response_summaryThe vendor was contacted early about this disclosure but did not respond in any way.The vendor was contacted early about this disclosure but did not respond in any way.The vendor was contacted early about this disclosure but did not respond in any way.
date1711494000 (2024-03-27)1711494000 (2024-03-27)1711494000 (2024-03-27)
cvss2_vuldb_acLLL
cvss2_vuldb_ciPPP
cvss2_vuldb_iiPPP
cvss2_vuldb_aiPPP
cvss2_vuldb_ePOCPOCPOC
cvss2_vuldb_rcURURUR
cvss4_vuldb_acLLL
cvss4_vuldb_vcLLL
cvss4_vuldb_viLLL
cvss4_vuldb_vaLLL
cvss4_vuldb_ePPP
cvss2_vuldb_avAAA
cvss2_vuldb_auSSS
cvss2_vuldb_rlNDNDND
cvss3_vuldb_avAAA
cvss3_vuldb_prLLL
cvss3_vuldb_uiNNN
cvss3_vuldb_rlXXX
cvss4_vuldb_avAAA
cvss4_vuldb_atNNN
cvss4_vuldb_prLLL
cvss4_vuldb_uiNNN
cvss4_vuldb_scNNN
cvss4_vuldb_siNNN
cvss4_vuldb_saNNN
cvss2_vuldb_basescore5.25.25.2
cvss2_vuldb_tempscore4.44.44.4
cvss3_vuldb_basescore5.55.55.5
cvss3_vuldb_tempscore5.05.05.0
cvss3_meta_basescore5.55.55.5
cvss3_meta_tempscore5.05.05.2
cvss4_vuldb_bscore5.15.15.1
cvss4_vuldb_btscore2.02.02.0
price_0day$0-$5k$0-$5k$0-$5k
cve_assigned1711494000 (2024-03-27)1711494000 (2024-03-27)
cve_nvd_summaryA vulnerability has been found in Tenda FH1202 1.2.0.14(408) and classified as critical. Affected by this vulnerability is the function formWriteFacMac of the file /goform/WriteFacMac. The manipulation of the argument mac leads to command injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258151. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.A vulnerability has been found in Tenda FH1202 1.2.0.14(408) and classified as critical. Affected by this vulnerability is the function formWriteFacMac of the file /goform/WriteFacMac. The manipulation of the argument mac leads to command injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258151. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
cvss2_nvd_avA
cvss2_nvd_acL
cvss2_nvd_auS
cvss2_nvd_ciP
cvss2_nvd_iiP
cvss2_nvd_aiP
cvss3_cna_avA
cvss3_cna_acL
cvss3_cna_prL
cvss3_cna_uiN
cvss3_cna_sU
cvss3_cna_cL
cvss3_cna_iL
cvss3_cna_aL
cve_cnaVulDB
cvss2_nvd_basescore5.2
cvss3_cna_basescore5.5

◂ 上一步一览下一步 ▸

Are you interested in using VulDB?

Download the whitepaper to learn more about our service!