| शीर्षक | Tenda M3 V1.0.0.13(4903) Stack-based Buffer Overflow |
|---|
| विवरण | The formSetVlanInfo handler in /bin/httpd calls formSetRemoteVlanInfo (under certain conditions) which is vulnerable to multiple stack overflows due to the complete absence of user input sanitization and bounds checking on parameters ID, vlan, and port which can lead to corruption of data on the stack, hijacking of control flow, and DoS. The attack can be performed remotely.
The vulnerability is in the memcpy() calls with no bounds checking.
The following conditions must be satisfied for this vulnerability to be exploitable:
✅ 1. Router configured with ac.workmode=master
✅ 2. HTTP request includes Cookie header
✅ 3. Cookie contains devUid parameter
✅ 4. devUid format: devUid=IP:PORT;
✅ 5. IP must be valid dotted-quad format (xxx.xxx.xxx.xxx)
Send a POST request to the /goform/setVlanInfo endpoint to trigger the stack overflow in formSetRemoteVlanInfo |
|---|
| स्रोत | ⚠️ https://github.com/dwBruijn/CVEs/blob/main/Tenda/setRemoteVlanInfo.md |
|---|
| उपयोगकर्ता | dwbruijn (UID 93926) |
|---|
| सबमिशन | 28/12/2025 05:31 PM (8 महीनों पहले) |
|---|
| संयम | 29/12/2025 09:01 AM (15 hours later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 338627 [Tenda M3 1.0.0.13(4903) /goform/setVlanInfo formSetRemoteVlanInfo ID/vlan/port बफ़र ओवरफ़्लो] |
|---|
| अंक | 20 |
|---|