| Название | Tenda CH22 V1.0.0.1 Denial of Service |
|---|
| Описание | A Denial of Service (DoS) vulnerability exists in the CH22 V1.0.0.1 firmware. The vulnerability is located in the fromDhcpListClient function, which handles DHCP static IP settings.
The application retrieves the value of the LISTLEN parameter from the HTTP request and converts it to an integer using atoi to determine the number of iterations for a loop. The code logic is roughly: for ( i = 1; i <= atoi(LISTLEN); ++i ).
However, there is no validation on the upper limit of the LISTLEN parameter. Inside the loop, the application performs resource-intensive operations, including string formatting (sprintf), parameter retrieval (websGetVar), and writing to NVRAM (SetValue).
An unauthenticated remote attacker can exploit this by sending a crafted HTTP POST request with LISTLEN set to an extremely large value (e.g., "1000000"). This forces the device to execute the loop millions of times, causing 100% CPU usage and exhaustion of system resources. This renders the web server (httpd) unresponsive, and typically triggers the system watchdog to reboot the device, resulting in a Denial of Service. |
|---|
| Источник | ⚠️ https://github.com/master-abc/cve/blob/main/Tenda%20CH22%20V1.0.0.1%20Router%20Denial%20of%20Service%20in%20fromDhcpListClient%20function.md |
|---|
| Пользователь | jiefengliang (UID 93721) |
|---|
| Представление | 22.12.2025 12:40 (9 месяцы назад) |
|---|
| Модерация | 28.12.2025 09:38 (6 days later) |
|---|
| Статус | Дубликат |
|---|
| Запись VulDB | 329906 [Tenda CH22 1.0.0.1 /goform/DhcpListClient fromDhcpListClient page повреждение памяти] |
|---|
| Баллы | 0 |
|---|