| Título | Tenda Tenda A18 V15.13.07.09 V15.13.07.09 Stack-based Buffer Overflow |
|---|
| Descrição | The Tenda A18 V15.13.07.09 is a dual-band tri-band router designed for households with up to 1000 Mbps fiber optics. It supports gigabit ports, intelligent frequency band selection, parental controls, and other features. The V15.13.07.09 model, produced by Shenzhen Tenda Technology Co., Ltd., has a binary vulnerability that allows an attacker to trigger a stack overflow and remotely execute malicious code.
The `SetCmdlineRun` function in Tenda A18 V15.13.07.09 version has a stack overflow vulnerability. Specifically, the function receives the `wpapsk_crypto5g` parameter via a POST request and passes it to the `set_repeat5` function.
In the `set_repeat5` function, the `wpapsk_cryptovalue` array is fixed at 16 bytes, but the user-controlled `wpapsk_crypto5g` parameter can overwrite the contents of this array, causing the `strcpy(wpapsk_cryptovalue, wpapsk_crypto)` statement to trigger a buffer overflow, leading to the execution of malicious code.
To trigger the vulnerable code, we set both `configured2_4g` to a value not equal to the string “true” and `configured5g` to the string “true,” which activates the vulnerable part of the `strcmp` condition. |
|---|
| Fonte | ⚠️ https://github.com/alc9700jmo/CVE/issues/9 |
|---|
| Utilizador | alc9700 (UID 79368) |
|---|
| Submissão | 20/01/2025 10h28 (há 1 Ano) |
|---|
| Moderação | 29/01/2025 18h09 (9 days later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 294011 [Tenda A18 até 15.13.07.09 HTTP POST Request /goform/SetCmdlineRun wpapsk_crypto5g Excesso de tampão] |
|---|
| Pontos | 20 |
|---|