| タイトル | Tenda AC15 Wireless Router V15.03.05.19 Stack-based Buffer Overflow |
|---|
| 説明 | A stack-based buffer overflow exists in the Tenda AC15 web management service `httpd` in firmware `US_AC15V1.0BR_V15.03.05.19_multi_TD01`. The issue is triggered in the GoAhead-based `/goform` request-handling path when the service processes an oversized HTTP POST body for the handler `/goform/WifiBasicSet`.
According to the supplied proof material, attacker-controlled POST body data is copied into a stack-resident buffer without sufficient length validation. A payload of approximately 98 bytes or more is reported to enter the corrupting state, while a 128-byte payload consisting of repeated `A` characters causes a characteristic ARM Thumb crash with `pc=0x81414141`. This value corresponds to the attacker-controlled pattern `0x41414141` interpreted as Thumb control flow, demonstrating overwrite of saved return control data on the stack.
Because the vulnerable component is the router's HTTP management service, successful exploitation can deny access to the management interface and may allow further control-flow hijacking. The observed overwrite of attacker-controlled return state indicates a realistic risk of remote code execution if the vulnerable handler is reachable over the network and applicable runtime protections do not prevent exploitation.
The currently supplied material specifically associates the issue with `POST /goform/WifiBasicSet` in Tenda AC15 firmware `US_AC15V1.0BR_V15.03.05.19_multi_TD01`. |
|---|
| ソース | ⚠️ https://gist.github.com/wyxstarry/30568ad72b7c0b503c2f21bcbedc2beb |
|---|
| ユーザー | Starry_1234 (UID 99644) |
|---|
| 送信 | 2026年07月09日 10:37 (2 月 ago) |
|---|
| モデレーション | 2026年08月23日 16:21 (2 months later) |
|---|
| ステータス | 重複 |
|---|
| VulDBエントリ | 206867 [Tenda AC15 15.03.05.18 httpd /goform/formWifiBasicSet メモリ破損] |
|---|
| ポイント | 0 |
|---|