| Название | Tenda AC5 V02.03.01.111_multi Buffer Overflow |
|---|
| Описание | A stack-based buffer overflow exists in the setWifi handler of Tenda AC5 v3 (firmware V02.03.01.111_multi), reachable via the wifiPwd parameter of the /goform/setWifi endpoint. An authenticated attacker can submit an oversized wifiPwd value that is copied into a fixed-size buffer without length validation, resulting in memory corruption and direct control of the program counter (PC register overwritten to 0x41414141, confirmed via crash dump). The overflow additionally corrupts the device's NVRAM configuration store, overwriting the wl0_wpa_psk key and surrounding entries, causing the device to crash on every subsequent boot as it re-parses the malformed configuration block — a persistent denial-of-service surviving reboot, not just a transient crash. |
|---|
| Источник | ⚠️ https://github.com/raisecnull/Tenda-AC5v3-BOF/blob/main/blog.md |
|---|
| Пользователь | raisecnull (UID 101471) |
|---|
| Представление | 20.09.2026 15:44 (16 дни назад) |
|---|
| Модерация | 05.10.2026 22:35 (15 days later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 413811 [Tenda AC5 02.03.01.111_multi Wifi /goform/setWifi wifiPwd повреждение памяти] |
|---|
| Баллы | 20 |
|---|