Stack-Based Buffer Overflow in Tenda FH1202 DHCP Client Allows Remote Exploitation

Executive Summary

[{'type': 'paragraph', 'content': 'CVE-2026-3810 is a stack-based buffer overflow vulnerability found in the Tenda FH1202 router firmware version 1.2.0.14(408). It exists in the HTTP daemon component, specifically in the fromDhcpListClient function that handles requests to the /goform/DhcpListClient endpoint.'}, {'type': 'paragraph', 'content': 'The vulnerability occurs because the function copies the user-supplied "page" parameter into a fixed-size stack buffer using the sprintf function without checking the length of the input. If an attacker sends an excessively long "page" parameter, it causes a stack buffer overflow.'}, {'type': 'paragraph', 'content': 'This overflow can lead to denial of service (DoS) or potentially allow remote code execution (RCE) on the affected device.'}] [1, 2, 3]

Useful 0 Not Useful 0

Impact Analysis

Exploiting this vulnerability can allow an attacker to remotely cause a denial of service (DoS) on the Tenda FH1202 router, making the device unavailable.

More severely, the attacker may achieve remote code execution (RCE), which means they could run arbitrary code on the router, potentially taking full control of the device.

This compromises the confidentiality, integrity, and availability of the router and any network traffic passing through it.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring HTTP POST requests sent to the /goform/DhcpListClient endpoint on the Tenda FH1202 router. Specifically, detection involves identifying requests that include an excessively long "page" parameter, which triggers the stack-based buffer overflow.'}, {'type': 'paragraph', 'content': 'A practical detection method is to capture and analyze network traffic targeting the router\'s HTTP daemon for suspiciously long "page" parameter values.'}, {'type': 'list_item', 'content': 'Use network packet capture tools like tcpdump or Wireshark to filter HTTP POST requests to /goform/DhcpListClient.'}, {'type': 'list_item', 'content': "Example tcpdump command to capture relevant traffic: tcpdump -i <interface> -A 'tcp port 80 and (((ip dst <router_ip>) and (tcp[((tcp[12] & 0xf0) >> 2):4] = 0x504f5354)))'"}, {'type': 'list_item', 'content': 'Inspect captured HTTP POST data for the "page" parameter length. Excessively long values may indicate exploitation attempts.'}, {'type': 'list_item', 'content': 'Alternatively, use web application firewall (WAF) rules or intrusion detection systems (IDS) to alert on unusually long "page" parameters in HTTP requests to /goform/DhcpListClient.'}] [1, 2]

Useful 0 Not Useful 0

Mitigation Strategies

[{'type': 'paragraph', 'content': 'No known mitigations or patches are currently available for this vulnerability.'}, {'type': 'paragraph', 'content': "Immediate mitigation steps include restricting access to the affected Tenda FH1202 router's HTTP management interface from untrusted networks to prevent remote exploitation."}, {'type': 'paragraph', 'content': 'It is recommended to replace the affected device with an alternative product that is not vulnerable to this issue.'}, {'type': 'paragraph', 'content': 'Monitoring network traffic for exploitation attempts and disabling remote management features if possible can also reduce risk.'}] [3]

Useful 0 Not Useful 0