| 제목 | Tenda AC5 V02.03.01.111_multi Buffer Overflow |
|---|
| 설명 | A stack-based buffer overflow exists in the setWifi handler of Tenda AC5 v3 (firmware V02.03.01.111_multi), reachable via the wifiPwd parameter of the /goform/setWifi endpoint. An authenticated attacker can submit an oversized wifiPwd value that is copied into a fixed-size buffer without length validation, resulting in memory corruption and direct control of the program counter (PC register overwritten to 0x41414141, confirmed via crash dump). The overflow additionally corrupts the device's NVRAM configuration store, overwriting the wl0_wpa_psk key and surrounding entries, causing the device to crash on every subsequent boot as it re-parses the malformed configuration block — a persistent denial-of-service surviving reboot, not just a transient crash. |
|---|
| 원천 | ⚠️ https://github.com/raisecnull/Tenda-AC5v3-BOF/blob/main/blog.md |
|---|
| 사용자 | raisecnull (UID 101471) |
|---|
| 제출 | 2026. 09. 20. PM 03:44 (16 날 ago) |
|---|
| 모더레이션 | 2026. 10. 05. PM 10:35 (15 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 413811 [Tenda AC5 02.03.01.111_multi Wifi /goform/setWifi wifiPwd 메모리 손상] |
|---|
| 포인트들 | 20 |
|---|