| शीर्षक | Tenda AC5 V02.03.01.111_multi Buffer Overflow |
|---|
| विवरण | A stack-based buffer overflow exists in the setWifi handler of Tenda AC5 v3 (firmware V02.03.01.111_multi), reachable via the wifiPwd parameter of the /goform/setWifi endpoint. An authenticated attacker can submit an oversized wifiPwd value that is copied into a fixed-size buffer without length validation, resulting in memory corruption and direct control of the program counter (PC register overwritten to 0x41414141, confirmed via crash dump). The overflow additionally corrupts the device's NVRAM configuration store, overwriting the wl0_wpa_psk key and surrounding entries, causing the device to crash on every subsequent boot as it re-parses the malformed configuration block — a persistent denial-of-service surviving reboot, not just a transient crash. |
|---|
| स्रोत | ⚠️ https://github.com/raisecnull/Tenda-AC5v3-BOF/blob/main/blog.md |
|---|
| उपयोगकर्ता | raisecnull (UID 101471) |
|---|
| सबमिशन | 20/09/2026 03:44 PM (15 दिन पहले) |
|---|
| संयम | 05/10/2026 10:35 PM (15 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 413811 [Tenda AC5 02.03.01.111_multi Wifi /goform/setWifi wifiPwd बफ़र ओवरफ़्लो] |
|---|
| अंक | 20 |
|---|