CVE-2024-3010 is a High severity (CVSS 8.8) stack-based buffer overflow in the Tenda FH1205 router, firmware 2.0.0, reached through the formSetCfm handler at /goform/setcfm. The record names no fixed firmware and says the vendor did not respond, so limit who can reach the admin interface and watch for a Tenda update.
What's affected
The record lists the Tenda FH1205 firmware at version 2.0.0 and the FH1205 hardware. No other versions are named, which does not prove other builds are safe, since the vendor has not published detail. The formSetCfm handler at /goform/setcfm copies the funcpara1 argument into a fixed size stack buffer without checking its length. The weaknesses are CWE-121 and CWE-787: a stack-based buffer overflow, which is a form of out-of-bounds write.
The description calls the issue "critical", which is VulDB's own wording. The CVSS 3.1 base score in the record is 8.8, which falls in the High band, and the vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. I report both: the text says critical, the score says high. The record also says the exploit has been disclosed to the public, tracked as VulDB entry 258296.
The vendor was contacted early about the disclosure and did not respond, according to the record. No fixed firmware version is named in the record or its references, so none is claimed here. Check the Tenda support and download pages for your model before you assume you are patched.
How to check if you're exposed
Log in to the router's admin page and read the firmware version on the system status or about screen. If it reads 2.0.0, you match the record.
Then check whether the admin interface is reachable from places you do not expect. From a machine outside your network, scan your router's public address for the web ports:
nmap -Pn -p 80,443,8080 YOUR_PUBLIC_IP
If a port answers, remote management is on. Turn it off unless you need it. The record's vector needs low privileges, so also check who has a login to the device and whether the password is still the factory default.
What to do now
- Confirm the model and firmware version on every Tenda FH1205 you manage.
- Check the vendor's support page for newer firmware and apply it if it exists. Do not assume one has been released.
- Disable remote management and keep the admin page reachable only from a trusted LAN segment.
- Replace default credentials with a long unique password.
- Plan to replace the device if the vendor stays silent. Consumer and small office routers with no patch path are a standing risk.
Why it matters
Stack overflows in embedded web servers are a long-running problem. Handlers written in C copy request fields into small buffers, and when the length check is missing, the extra bytes overwrite neighboring memory. On a router that can mean a crash at minimum, and the record rates confidentiality, integrity and availability impact as high. I will not describe how it is triggered, since the advisory does not need that detail for you to act.
The record does not list this CVE as exploited in the wild, and it carries no CISA Known Exploited Vulnerabilities flag. It does say a public write-up exists, so attackers can read the same material you can. Several Tenda models received near identical reports on the same day, which suggests the same code is shared across the product line.
The Gold page for CVE-2024-3010 tracks the entry. Device firmware is outside what the free dependency scan at gold.safeguard.sh/scan examines, but it works well for the software you build and ship yourself.
Quick check
How bad is this?
The CVSS 3.1 base score is 8.8 (High), with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. It reaches the device over the network and needs low privileges. Impact on confidentiality, integrity and availability is rated high.
Is there a patch?
The record does not name one and says the vendor did not respond to the disclosure. Check Tenda support for your model and treat the device as exposed until you confirm an update.
Sources
Last reviewed: 19 October 2026.
