CVE-2024-30637

Name of the Vulnerable Software and Affected Versions Tenda F1202 version 1.2.0.20(408)

Description The issue is related to the formWriteFacMac function, specifically the /goform/WriteFacMac API endpoint, where a command injection vulnerability exists due to inadequate data cleaning at the management level. This allows a remote attacker to execute arbitrary commands. The vulnerability is associated with the mac parameter.

Recommendations For Tenda F1202 version 1.2.0.20(408), consider disabling the formWriteFacMac function or restricting access to the /goform/WriteFacMac API endpoint until a patch is available. Avoid using the mac parameter in the affected API endpoint to minimize the risk of exploitation.