CVE-2024-3009 is a Medium severity (CVSS 6.3) command injection in the Tenda FH1205 router, firmware 2.0.0, reached through the formWriteFacMac handler at /goform/WriteFacMac. The record names no fixed firmware and says the vendor did not respond, so limit who can reach the admin interface and watch for a Tenda update.
What's affected
The record lists the Tenda FH1205 firmware at version 2.0.0 and the FH1205 hardware. No other versions are named, which does not prove other builds are safe, since the vendor has not published detail. The formWriteFacMac handler at /goform/WriteFacMac passes the mac argument into an operating system command without safe handling. The weakness is CWE-77, which covers improper neutralization of special elements in a command.
The description calls the issue "critical", which is VulDB's own wording. The CVSS 3.1 base score in the record is 6.3, which falls in the Medium band, and the vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. I report both: the text says critical, the score says medium. The record also says the exploit has been disclosed to the public, tracked as VulDB entry 258295.
The vendor was contacted early about the disclosure and did not respond, according to the record. No fixed firmware version is named in the record or its references, so none is claimed here. Check the Tenda support and download pages for your model before you assume you are patched.
How to check if you're exposed
Log in to the router's admin page and read the firmware version on the system status or about screen. If it reads 2.0.0, you match the record.
Then check whether the admin interface is reachable from places you do not expect. From a machine outside your network, scan your router's public address for the web ports:
nmap -Pn -p 80,443,8080 YOUR_PUBLIC_IP
If a port answers, remote management is on. Turn it off unless you need it. The record's vector needs low privileges, so also check who has a login to the device and whether the password is still the factory default.
What to do now
- Confirm the model and firmware version on every Tenda FH1205 you manage.
- Check the vendor's support page for newer firmware and apply it if it exists. Do not assume one has been released.
- Disable remote management and keep the admin page reachable only from a trusted LAN segment.
- Replace default credentials with a long unique password.
- Plan to replace the device if the vendor stays silent. Consumer and small office routers with no patch path are a standing risk.
Why it matters
Command injection means input that should be data ends up interpreted as part of a command. On a router, the command runs with the privileges of the web service, which is often root. The record scores this lower than the overflow bugs in the same firmware because the vector reflects over the network reach and low impact ratings, but the pattern is the same: a form handler trusts what it is given.
The record does not list this CVE as exploited in the wild, and it carries no CISA Known Exploited Vulnerabilities flag. It does say a public write-up exists, so attackers can read the same material you can. Several Tenda models received near identical reports on the same day, which suggests the same code is shared across the product line.
The Gold page for CVE-2024-3009 tracks the entry. Device firmware is outside what the free dependency scan at gold.safeguard.sh/scan examines, but it works well for the software you build and ship yourself.
Quick check
What does the score tell me?
The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, giving 6.3. The attack reaches the device over the network, needs low privileges, and each impact rating is low. A real network may be worse or better depending on who can reach the admin page.
Is there a patch?
The record does not name one and says the vendor did not respond to the disclosure. Check Tenda support for your model and treat the device as exposed until you confirm an update.
Sources
Last reviewed: 19 October 2026.
