CVE-2020-13390 in AC6
Summary
by MITRE
An issue was discovered on Tenda AC6 V1.0 V15.03.05.19_multi_TD01, AC9 V1.0 V15.03.05.19(6318)_CN, AC9 V3.0 V15.03.06.42_multi, AC15 V1.0 V15.03.05.19_multi_TD01, and AC18 V15.03.05.19(6318_)_CN devices. There is a buffer overflow vulnerability in the router's web server -- httpd. While processing the /goform/addressNat entrys and mitInterface parameters for a POST request, a value is directly used in a sprintf to a local variable placed on the stack, which overwrites the return address of a function. An attacker can construct a payload to carry out arbitrary code execution attacks.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 05/23/2020
This vulnerability exists within the Tenda wireless router firmware versions AC6 V1.0 V15.03.05.19_multi_TD01, AC9 V1.0 V15.03.05.19(6318)CN, AC9 V3.0 V15.03.06.42_multi, AC15 V1.0 V15.03.05.19_multi_TD01, and AC18 V15.03.05.19(6318)_CN. The issue resides in the httpd web server component that handles POST requests to the /goform/addressNat endpoint. The vulnerability manifests when processing the addressNat entrys and mitInterface parameters, creating a classic stack-based buffer overflow condition that directly impacts the program's execution flow.
The technical flaw occurs during the string formatting operation where user-supplied input is directly passed to the sprintf function without proper bounds checking. This uncontrolled data handling allows an attacker to overflow the local stack buffer and overwrite the function's return address, effectively hijacking the program execution control flow. The vulnerability is classified as a buffer overflow under CWE-121, specifically a stack-based buffer overflow with a return address overwrite, which represents a critical security weakness in the firmware's input validation mechanisms. This type of vulnerability allows for arbitrary code execution, making it particularly dangerous for networked devices.
The operational impact of this vulnerability is severe as it provides remote attackers with the capability to execute arbitrary code on affected devices without requiring authentication. This enables attackers to gain full control over the router's functionality, potentially leading to complete network compromise, data exfiltration, or the establishment of persistent backdoors. The vulnerability affects multiple Tenda router models, amplifying the potential attack surface across various network environments. From an ATT&CK framework perspective, this vulnerability maps to T1059.007 (Command and Scripting Interpreter: PowerShell) and T1068 (Exploitation for Privilege Escalation) techniques, as attackers can leverage the code execution capability to escalate privileges and maintain persistent access.
The attack vector requires a simple HTTP POST request to the vulnerable endpoint with crafted malicious input parameters. This makes the vulnerability particularly dangerous as it can be exploited remotely without requiring physical access or specialized credentials. The vulnerability's exploitation directly relates to the MITRE ATT&CK matrix's T1210 (Exploitation of Remote Services) and T1499.004 (Endpoint Denial of Service) categories, as it enables unauthorized access to network infrastructure. Organizations should immediately implement network segmentation to isolate affected devices, apply firmware updates from Tenda when available, and monitor for suspicious network traffic patterns that might indicate exploitation attempts. Network intrusion detection systems should be configured to detect and alert on suspicious POST requests to the /goform/addressNat endpoint, as this represents a clear indicator of potential exploitation attempts.