| タイトル | Tenda AC18 V15.03.05.19_multi Stack-based Buffer Overflow |
|---|
| 説明 | Title: Remote Stack-Based Buffer Overflow in Tenda AC18 via Profile Retrieval in sub_34A18 (PPPOEPassword)
Description:
A critical stack-based buffer overflow vulnerability was identified in the HTTP server daemon (httpd) of the Tenda AC18 router (firmware version V15.03.05.19_multi).
Vulnerability Mechanism:
The issue arises from an insecure data flow between the quick setup configuration handler and the profile processing subsystem. In the web form handler function formQuickIndex, an attacker can supply an arbitrarily long payload via the HTTP POST argument PPPOEPassword. The application saves this untrusted input directly into the system database under the key wan1.ppoe.pwd.
Subsequently, during internal configuration processing or status retrieval within the sub_34A18 function, the application fetches the stored wan1.ppoe.pwd profile and attempts to write it into a fixed-size stack buffer v12. However, the destination buffer v12 is allocated on the stack with a restricted capacity of only 68 bytes (char v12[68] or equivalent). Because the data retrieval operation is executed without any boundary validation or size verification relative to the target buffer, supplying a profile value longer than 68 bytes triggers an immediate memory overwrite.
Impact:
By submitting a crafted PPPOEPassword parameter exceeding 68 bytes in a prior quick setup request, a remote attacker can force a linear stack overflow during the configuration processing phase. The excessive data spills past the boundaries of v12, corrupting adjacent stack memory variables and overwriting the saved return address (Return Address). Consequently, a remote attacker can exploit this vulnerability to induce a persistent Denial of Service (DoS) via httpd daemon crashes or potentially achieve arbitrary remote code execution (RCE) with root privileges.
Exploit/PoC Target Parameter: PPPOEPassword (via POST request to /goform/formQuickIndex) |
|---|
| ソース | ⚠️ https://github.com/mz21g/vulnerabilities/tree/main/Tenda/AC18/vuln_8 |
|---|
| ユーザー | yanzhichen (UID 98986) |
|---|
| 送信 | 2026年06月14日 19:30 (4 月 ago) |
|---|
| モデレーション | 2026年07月20日 09:10 (1 month later) |
|---|
| ステータス | 重複 |
|---|
| VulDBエントリ | 256893 [Tenda AC18 15.03.05.05 /goform/QuickIndex formQuickIndex PPPOEPassword メモリ破損] |
|---|
| ポイント | 0 |
|---|