| 제목 | Tenda CH22 V1.0.0.1 Denial of Service |
|---|
| 설명 | A Denial of Service (DoS) vulnerability exists in the CH22 V1.0.0.1 firmware. The vulnerability is located in the fromDhcpListClient function, which handles DHCP static IP settings.
The application retrieves the value of the LISTLEN parameter from the HTTP request and converts it to an integer using atoi to determine the number of iterations for a loop. The code logic is roughly: for ( i = 1; i <= atoi(LISTLEN); ++i ).
However, there is no validation on the upper limit of the LISTLEN parameter. Inside the loop, the application performs resource-intensive operations, including string formatting (sprintf), parameter retrieval (websGetVar), and writing to NVRAM (SetValue).
An unauthenticated remote attacker can exploit this by sending a crafted HTTP POST request with LISTLEN set to an extremely large value (e.g., "1000000"). This forces the device to execute the loop millions of times, causing 100% CPU usage and exhaustion of system resources. This renders the web server (httpd) unresponsive, and typically triggers the system watchdog to reboot the device, resulting in a Denial of Service. |
|---|
| 원천 | ⚠️ https://github.com/master-abc/cve/issues/7 |
|---|
| 사용자 | jiefengliang (UID 93721) |
|---|
| 제출 | 2025. 12. 28. PM 04:49 (9 개월 ago) |
|---|
| 모더레이션 | 2025. 12. 29. AM 08:50 (16 hours later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 338625 [Tenda CH22 까지 1.0.0.1 /goform/DhcpListClient fromDhcpListClient LISTLEN 서비스 거부] |
|---|
| 포인트들 | 20 |
|---|