| عنوان | Tenda AC15 Wireless Router V15.03.05.19 Stack-based Buffer Overflow |
|---|
| الوصف | A stack-based buffer overflow exists in the Tenda AC15 web management service `httpd` in firmware `US_AC15V1.0BR_V15.03.05.19_multi_TD01`. The issue is triggered in the GoAhead-based `/goform` request-handling path when the service processes an oversized HTTP POST body for the handler `/goform/WifiBasicSet`.
According to the supplied proof material, attacker-controlled POST body data is copied into a stack-resident buffer without sufficient length validation. A payload of approximately 98 bytes or more is reported to enter the corrupting state, while a 128-byte payload consisting of repeated `A` characters causes a characteristic ARM Thumb crash with `pc=0x81414141`. This value corresponds to the attacker-controlled pattern `0x41414141` interpreted as Thumb control flow, demonstrating overwrite of saved return control data on the stack.
Because the vulnerable component is the router's HTTP management service, successful exploitation can deny access to the management interface and may allow further control-flow hijacking. The observed overwrite of attacker-controlled return state indicates a realistic risk of remote code execution if the vulnerable handler is reachable over the network and applicable runtime protections do not prevent exploitation.
The currently supplied material specifically associates the issue with `POST /goform/WifiBasicSet` in Tenda AC15 firmware `US_AC15V1.0BR_V15.03.05.19_multi_TD01`. |
|---|
| المصدر | ⚠️ https://gist.github.com/wyxstarry/30568ad72b7c0b503c2f21bcbedc2beb |
|---|
| المستخدم | Starry_1234 (UID 99644) |
|---|
| ارسال | 09/07/2026 10:37 AM (2 أشهر منذ) |
|---|
| الاعتدال | 23/08/2026 04:21 PM (2 months later) |
|---|
| الحالة | مكرر |
|---|
| إدخال VulDB | 206867 [Tenda AC15 15.03.05.18 httpd /goform/formWifiBasicSet تلف الذاكرة] |
|---|
| النقاط | 0 |
|---|