Submeter #858411: Tenda AC10 V4.0 V16.03.10.09_multi_TDE01 Memory Corruption

A stack-based buffer overflow vulnerability exists in the Tenda AC10 V4.0 router firmware, in the fromAdvSetLanip HTTP POST request handler (⚠ /goform/AdvSetLanip). The vulnerability results from a buffer-size mismatch between the configuration write and read routines: user-supplied input is accepted at a length large enough to overflow smaller destination buffers, while the read routine copies stored values without regard to the destination's capacity.
PREREQUISITES:

Requires an authenticated session. The fromAdvSetLanip handler is reachable only after administrator login.
ROOT CAUSE:

The vulnerability chain involves two functions exported from libcommon.so:

SetValue(key, value) — stores user input to NVRAM

Accepts input up to 1499 bytes (0x5dc)
Persists the full value to NVRAM without truncating it to any consumer's buffer size

GetValue(key, out_buf) — retrieves an NVRAM value into a caller-supplied buffer

Copies using strlen(nvram_value) as the length bound
Receives no parameter indicating the caller's buffer capacity
Copies the entire stored value regardless of destination size
The copy is bounded by the source length rather than the destination size, so it behaves like strcpy and overflows the stack whenever the destination buffer is smaller than the stored value

ATTACK VECTOR:

Authenticated attacker sends POST /goform/AdvSetLanip with lanIp set to an oversized value (e.g. 500 bytes, within the 1499-byte limit SetValue accepts)

→ SetValue("lan.ip", "AAAA...") persists ~500 bytes to NVRAM
A subsequent request that causes fromAdvSetLanip to read this key

→ fromAdvSetLanip calls GetValue("lan.ip", stack_buffer) where the destination is a 16-byte stack buffer

→ GetValue copies the full ~500-byte value into the 16-byte buffer

→ ~484 bytes are written past the buffer boundary, corrupting the saved frame pointer and saved return address ($fp, $ra on MIPS)

IMPACT:

Confirmed stack corruption resulting in a crash of the httpd daemon (denial of service). Overwrite of the saved return address occurs; arbitrary code execution may be achievable depending on the platform's exploit mitigations, but has not been demonstrated in this report.
CRASH EVIDENCE:

Confirmed reproducible on Tenda AC10 V4.0:

Request 1: POST /goform/AdvSetLanip with an oversized lanIp parameter
Request 2: ⚠ [the exact request used to trigger the read of lan.ip]
Result: httpd daemon crashes with stack corruption / segmentation fault

• Fonte: ⚠️ https://github.com/teiwiet/tenda-ac10-vulnerabilities/blob/main/advisory-fromAdvSetLanip.md
• Utilizador: teiwiet (UID 98971)
• Submissão: 15/06/2026 01h14 (há 1 mês)
• Moderação: 20/07/2026 09h14 (1 month later)
• Estado: Aceite
• Entrada VulDB: 380539 [Tenda AC10 16.03.10.09_multi_TDE01 httpd/netctrl /goform/AdvSetLanip fromAdvSetLanip GetValue/SetValue Excesso de tampão]
• Pontos: 20