CVE-2024-42981 identifies a stack overflow vulnerability in the Tenda FH1206 router firmware version v02.03.01.35. The vulnerability arises from improper handling of the delno parameter within the fromPptpUserSetting function. An attacker can craft a malicious POST request targeting this parameter to overflow the stack, leading to a Denial of Service (DoS) by crashing or destabilizing the router. The vulnerability is remotely exploitable without requiring authentication or user interaction, increasing its risk profile. The Common Weakness Enumeration (CWE) classification is CWE-400, indicating a resource exhaustion or DoS condition. The CVSS v3.1 base score is 7.5 (high), reflecting the network attack vector, low attack complexity, no privileges required, and no user interaction needed, with impact limited to availability. No known exploits have been reported in the wild, and no official patches have been published at the time of disclosure. This vulnerability could disrupt network connectivity for users relying on the affected router firmware, potentially impacting both home and small business environments.

The primary impact of CVE-2024-42981 is a Denial of Service condition that can render the Tenda FH1206 router unavailable or unstable. This disruption can interrupt internet connectivity and internal network communications, affecting productivity and operational continuity. Organizations using these routers, especially in small office or home office (SOHO) environments, may experience network outages, impacting remote work, VoIP, and other critical services. The vulnerability does not directly compromise confidentiality or integrity but poses a significant availability risk. Given the router's role as a network gateway, prolonged downtime could expose networks to secondary risks if fallback or backup systems are not in place. The lack of authentication requirements and remote exploitability increases the likelihood of exploitation in unprotected network environments.

Until an official patch is released by Tenda, organizations should implement the following mitigations: 1) Restrict access to the router's management interface by limiting exposure to trusted networks and disabling remote management if not required. 2) Employ network-level protections such as firewalls or intrusion prevention systems (IPS) to detect and block suspicious POST requests targeting the delno parameter or unusual traffic patterns to the router. 3) Monitor router logs and network traffic for signs of attempted exploitation or abnormal crashes. 4) Consider temporary replacement or segmentation of affected routers in critical environments to minimize impact. 5) Stay updated with vendor advisories for patch releases and apply firmware updates promptly once available. 6) Educate users on the risks and encourage reporting of connectivity issues that may indicate exploitation attempts.