| 제목 | Tenda AC15 15.03.05.18 Memory Corruption |
|---|
| 설명 | A stack-based buffer overflow exists in the formWifiBasicSet function of the Tenda AC15 router firmware V15.03.05.18. The vulnerability is in the httpd binary which handles HTTP requests on the device. When processing a POST request to /goform/WifiBasicSet, the function reads the "security" and "security_5g" parameters via websGetVar() and copies them into 256-byte stack buffers using strcpy() with no length validation. By sending a parameter value longer than 256 bytes, an attacker can overwrite the saved return address on the stack and hijack program control flow. A full remote code execution exploit has been developed using a ROP chain (pop r3 + mov r0,sp + blx r3) to call libc system() with an attacker-controlled command string, achieving arbitrary command execution as root. The vulnerability requires LAN access and cookie-based authentication (default credentials). Proof of concept and exploit code are included in the attached archive. |
|---|
| 원천 | ⚠️ https://files.catbox.moe/py6j1f.zip |
|---|
| 사용자 | meshaal (UID 96796) |
|---|
| 제출 | 2026. 03. 25. PM 04:19 (6 개월 ago) |
|---|
| 모더레이션 | 2026. 04. 08. PM 06:57 (14 days later) |
|---|
| 상태 | 중복 |
|---|
| VulDB 항목 | 206867 [Tenda AC15 15.03.05.18 httpd /goform/formWifiBasicSet 메모리 손상] |
|---|
| 포인트들 | 0 |
|---|