| タイトル | Tenda CH22 V1.0.0.1 Denial of Service |
|---|
| 説明 | A Denial of Service (DoS) vulnerability exists in the CH22 V1.0.0.1 firmware. The vulnerability is located in the fromDhcpListClient function, which handles DHCP static IP settings.
The application retrieves the value of the LISTLEN parameter from the HTTP request and converts it to an integer using atoi to determine the number of iterations for a loop. The code logic is roughly: for ( i = 1; i <= atoi(LISTLEN); ++i ).
However, there is no validation on the upper limit of the LISTLEN parameter. Inside the loop, the application performs resource-intensive operations, including string formatting (sprintf), parameter retrieval (websGetVar), and writing to NVRAM (SetValue).
An unauthenticated remote attacker can exploit this by sending a crafted HTTP POST request with LISTLEN set to an extremely large value (e.g., "1000000"). This forces the device to execute the loop millions of times, causing 100% CPU usage and exhaustion of system resources. This renders the web server (httpd) unresponsive, and typically triggers the system watchdog to reboot the device, resulting in a Denial of Service. |
|---|
| ソース | ⚠️ https://github.com/master-abc/cve/issues/7 |
|---|
| ユーザー | jiefengliang (UID 93721) |
|---|
| 送信 | 2025年12月28日 16:49 (9 月 ago) |
|---|
| モデレーション | 2025年12月29日 08:50 (16 hours later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 338625 [Tenda CH22 迄 1.0.0.1 /goform/DhcpListClient fromDhcpListClient LISTLEN サービス拒否] |
|---|
| ポイント | 20 |
|---|