| タイトル | Tenda AC18 V15.03.05.19_multi Stack-based Buffer Overflow |
|---|
| 説明 | Title: Remote Stack-Based Buffer Overflow in Tenda AC18 via Insecure Memory Copy in formSetFirewallCfg (firewallEn)
Description:
A critical stack-based buffer overflow vulnerability was identified in the HTTP server daemon (httpd) of the Tenda AC18 router (firmware version V15.03.05.19_multi).
Vulnerability Mechanism:
The issue exists within the web form handler function formSetFirewallCfg, which processes firewall configurations. When a user submits an HTTP POST request containing the firewallEn parameter, the application extracts this untrusted string input and assigns it to the local variable src.
To validate the input, the program calculates the length of src and stores the result in the variable Value. The program then checks if the length is greater than 3 (if (Value > 3)). However, while enforcing a minimum length requirement, the application completely fails to verify or restrict the upper bounds of the input data. Consequently, if the condition is met, the untrusted src string is copied directly into a fixed-size stack destination buffer dest using an unsafe copy operation (such as strcpy). Since dest is allocated with a rigid capacity of only 4 bytes (char dest[4]), any input string significantly longer than 4 bytes will exceed the boundary.
Impact:
By sending a crafted firewallEn parameter that excessively exceeds 4 bytes, a remote attacker can trigger a linear memory overwrite on the stack frame. This memory corruption cleanly obliterates adjacent stack variables and subverts the saved return address (Saved PC). Upon function termination, the execution flow is successfully hijacked, enabling the attacker to induce a permanent Denial of Service (DoS) by crashing the web service or potentially execute arbitrary remote code (RCE) with root privileges. |
|---|
| ソース | ⚠️ https://github.com/mz21g/vulnerabilities/tree/main/Tenda/AC18/vuln_10 |
|---|
| ユーザー | yanzhichen (UID 98986) |
|---|
| 送信 | 2026年06月22日 17:25 (4 月 ago) |
|---|
| モデレーション | 2026年08月08日 18:23 (2 months later) |
|---|
| ステータス | 重複 |
|---|
| VulDBエントリ | 257155 [Tenda AC18 15.03.05.05 formSetFirewallCfg firewallEn メモリ破損] |
|---|
| ポイント | 0 |
|---|