CVE-2024-42944 is a stack-based buffer overflow vulnerability identified in the Tenda FH1201 router firmware version 1.2.0.14 (build 408). The vulnerability arises from improper handling of the 'page' parameter within the fromNatlimit function. An attacker can craft a specially formatted POST request targeting this parameter, which causes the function to overflow the stack buffer. This overflow leads to a denial of service condition by crashing the router or causing it to become unresponsive. The vulnerability does not require any authentication or user interaction, making it remotely exploitable over the network. The CVSS v3.1 base score is 6.5, reflecting a medium severity level due to the lack of confidentiality or integrity impact and the limited scope to availability disruption only. The weakness is classified under CWE-121 (Stack-based Buffer Overflow). Currently, no patches or official remediation guidance have been published by Tenda, and no active exploitation has been reported. The vulnerability affects a specific firmware version, and users should verify their device version to assess exposure.

The primary impact of CVE-2024-42944 is the potential for denial of service on affected Tenda FH1201 routers. This can disrupt network connectivity for organizations relying on these devices, potentially causing downtime and loss of productivity. Since the vulnerability does not compromise confidentiality or integrity, the risk of data breach or manipulation is low. However, the loss of availability can affect business operations, especially in environments where these routers serve as critical network gateways or are deployed in large numbers. The ease of exploitation without authentication increases the risk of automated attacks or scanning by threat actors. Organizations with remote or unmanaged Tenda FH1201 devices are particularly vulnerable to network-based DoS attacks leveraging this flaw.

To mitigate CVE-2024-42944, organizations should first verify if they are using the affected Tenda FH1201 firmware version 1.2.0.14 (408). If so, they should monitor Tenda’s official channels for patches or firmware updates addressing this vulnerability and apply them promptly once available. In the interim, network administrators can implement access control measures such as firewall rules to restrict inbound POST requests to the router’s management interface from untrusted networks. Disabling remote management or restricting it to trusted IP addresses can reduce exposure. Network segmentation can also limit the impact of a compromised or crashed router. Additionally, monitoring network traffic for unusual POST requests targeting the router may help detect exploitation attempts. Regularly backing up router configurations and having contingency plans for device replacement or reboot can minimize downtime if a DoS occurs.