| عنوان | Tenda Tenda A18 V15.13.07.09 V15.13.07.09 Stack-based Buffer Overflow |
|---|
| الوصف | The Tenda A18 V15.13.07.09 is a dual-band tri-band router designed for households with up to 1000 Mbps fiber optics. It supports gigabit ports, intelligent frequency band selection, parental controls, and other features. The V15.13.07.09 model, produced by Shenzhen Tenda Technology Co., Ltd., has a binary vulnerability that allows an attacker to trigger a stack overflow and remotely execute malicious code.
The `SetCmdlineRun` function in Tenda A18 V15.13.07.09 version has a stack overflow vulnerability. Specifically, the function receives the `wpapsk_crypto5g` parameter via a POST request and passes it to the `set_repeat5` function.
In the `set_repeat5` function, the `wpapsk_cryptovalue` array is fixed at 16 bytes, but the user-controlled `wpapsk_crypto5g` parameter can overwrite the contents of this array, causing the `strcpy(wpapsk_cryptovalue, wpapsk_crypto)` statement to trigger a buffer overflow, leading to the execution of malicious code.
To trigger the vulnerable code, we set both `configured2_4g` to a value not equal to the string “true” and `configured5g` to the string “true,” which activates the vulnerable part of the `strcmp` condition. |
|---|
| المصدر | ⚠️ https://github.com/alc9700jmo/CVE/issues/9 |
|---|
| المستخدم | alc9700 (UID 79368) |
|---|
| ارسال | 20/01/2025 10:28 AM (1 سنة منذ) |
|---|
| الاعتدال | 29/01/2025 06:09 PM (9 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 294011 [Tenda A18 حتى 15.13.07.09 HTTP POST Request /goform/SetCmdlineRun wpapsk_crypto5g تلف الذاكرة] |
|---|
| النقاط | 20 |
|---|