| शीर्षक | Tenda AC18 V15.03.05.19_multi Stack-based Buffer Overflow |
|---|
| विवरण | Title: Remote Stack-Based Buffer Overflow in Tenda AC18 via Integer Formatting in formWifiMacFilterSet (ssid_index)
Description:
A critical stack-based buffer overflow vulnerability was identified in the HTTP server daemon (httpd) of the Tenda AC18 router (firmware version V15.03.05.19_multi).
Vulnerability Mechanism:
The vulnerability resides within the web form handler function formWifiMacFilterSet, which manages wireless MAC address filtering. An attacker can supply an arbitrarily long or large numeric value via the HTTP POST argument ssid_index. The application retrieves this string, converts it into an integer via atoi, and assigns the result to the variable v22.
Near the exit of the function, the application attempts to serialize this value into a response payload using the statement sprintf(v14, "%d;%s", v22, ...). However, the destination buffer v14 is allocated on the stack with a rigid capacity of only 4 bytes (char v14[4]). If an attacker passes a large integer value (such as 2147483645), the formatted string output of the signed integer (e.g., "2147483645;0") will easily require up to 13 or more bytes, including the null terminator.
Impact:
Because sprintf lacks any length boundary restrictions or truncations based on the target array's dimensions, formatting this large integer triggers an immediate linear stack overflow. The overflow spills out of v14 and sequentially overwrites critical adjacent structures, local execution pointers, and the saved return address (Return Address) on the stack frame. Consequently, a remote attacker can exploit this condition to cause a reliable Denial of Service (DoS) via httpd daemon crashes or potentially achieve arbitrary remote code execution (RCE) with root privileges.
Exploit/PoC Target Parameter: ssid_index (via POST request to /goform/WifiMacFilterSet) |
|---|
| स्रोत | ⚠️ https://github.com/mz21g/vulnerabilities/tree/main/Tenda/AC18/vuln_6 |
|---|
| उपयोगकर्ता | yanzhichen (UID 98986) |
|---|
| सबमिशन | 14/06/2026 07:26 PM (4 महीनों पहले) |
|---|
| संयम | 20/07/2026 09:10 AM (1 month later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 327209 [Tenda AC18 15.03.05.19(6318) /goform/WifiMacFilterSet wifi_chkHz बफ़र ओवरफ़्लो] |
|---|
| अंक | 0 |
|---|