| タイトル | Tenda AC18 V15.03.05.19_multi Stack-based Buffer Overflow |
|---|
| 説明 | Title: Remote Stack-Based Buffer Overflow in Tenda AC18 via GetValue in formGetSysToolDDNS
Description:
A critical stack-based buffer overflow vulnerability was identified in the HTTP server daemon (httpd) of the Tenda AC18 router (firmware version V15.03.05.19_multi).
Vulnerability Mechanism:
The issue stems from an insecure data flow between configuration storage and profile retrieval handlers. In the web form configuration function formSetSysToolDDNS, an attacker can supply an arbitrarily long payload via the HTTP POST argument serverName. The application saves this untrusted input directly into the system database under the key adv.ddns1.type.
Subsequently, when the configuration status is queried via the formGetSysToolDDNS function, the application invokes the GetValue function to fetch the stored adv.ddns1.type profile. However, GetValue transfers the data without any boundary validation into a fixed-size stack buffer v16, which is allocated with only 32 bytes of capacity (_BYTE v16[32]).
Impact:
By submitting a crafted serverName parameter exceeding 32 bytes in a prior request, a remote attacker can trigger a linear stack overwrite during the status retrieval phase. This corrupts the local stack frame and hijacks the saved return address, allowing the attacker to cause a persistent Denial of Service (DoS) by crashing the httpd daemon or potentially achieve full remote code execution (RCE) with root privileges. |
|---|
| ソース | ⚠️ https://github.com/mz21g/vulnerabilities/tree/main/Tenda/AC18/vuln_1 |
|---|
| ユーザー | yanzhichen (UID 98986) |
|---|
| 送信 | 2026年06月14日 19:11 (4 月 ago) |
|---|
| モデレーション | 2026年07月20日 09:09 (1 month later) |
|---|
| ステータス | 重複 |
|---|
| VulDBエントリ | 327211 [Tenda AC18 15.03.05.19(6318) /goform/SetDDNSCfg ddnsEn メモリ破損] |
|---|
| ポイント | 0 |
|---|