CVE-2020-13392 in AC6
Summary
by MITRE
An issue was discovered on Tenda AC6 V1.0 V15.03.05.19_multi_TD01, AC9 V1.0 V15.03.05.19(6318)_CN, AC9 V3.0 V15.03.06.42_multi, AC15 V1.0 V15.03.05.19_multi_TD01, and AC18 V15.03.05.19(6318_)_CN devices. There is a buffer overflow vulnerability in the router's web server -- httpd. While processing the /goform/setcfm funcpara1 parameter for a POST request, a value is directly used in a sprintf to a local variable placed on the stack, which overwrites the return address of a function. An attacker can construct a payload to carry out arbitrary code execution attacks.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 05/23/2020
This vulnerability exists within the Tenda wireless router firmware versions AC6 V1.0 V15.03.05.19_multi_TD01, AC9 V1.0 V15.03.05.19(6318)CN, AC9 V3.0 V15.03.06.42_multi, AC15 V1.0 V15.03.05.19_multi_TD01, and AC18 V15.03.05.19(6318)_CN. The flaw resides in the httpd web server component that handles POST requests to the /goform/setcfm endpoint. The vulnerability manifests when processing the funcpara1 parameter, where user-supplied input is directly passed to a sprintf function without proper bounds checking. This creates a classic stack-based buffer overflow condition that allows attackers to overwrite the function's return address on the call stack.
The technical implementation of this vulnerability follows CWE-121 Stack-based Buffer Overflow, where insufficient bounds checking enables an attacker to write beyond the allocated buffer space. The sprintf function receives unvalidated user input from the funcpara1 parameter and writes it to a local stack variable, causing the overflow to overwrite the saved return address. This manipulation of the call stack enables attackers to redirect program execution flow to arbitrary code locations within the router's memory space. The vulnerability represents a critical security flaw that can be exploited without authentication, as the affected httpd service is accessible over the network.
The operational impact of this vulnerability is severe as it enables remote code execution attacks against affected Tenda router models. An attacker can craft malicious POST requests to the vulnerable endpoint, potentially allowing full system compromise including arbitrary code execution, privilege escalation, and persistent access to the network infrastructure. The vulnerability affects multiple router models and firmware versions, indicating a widespread issue that could impact numerous network endpoints. This type of vulnerability falls under the ATT&CK technique T1059.007 Command and Scripting Interpreter: PowerShell, as it enables attackers to execute arbitrary commands on the affected systems.
Mitigation strategies should include immediate firmware updates from Tenda to address the buffer overflow condition, network segmentation to limit access to affected devices, and implementation of network monitoring to detect suspicious POST requests to the vulnerable endpoint. Organizations should also consider disabling unnecessary web management interfaces, implementing firewall rules to restrict access to the router's administrative ports, and conducting comprehensive network assessments to identify all affected devices. The vulnerability demonstrates the critical importance of input validation and proper bounds checking in embedded web server implementations, particularly in network infrastructure devices that are often left unpatched and accessible to external networks.