| Title | Tenda AC6/AC9/AC15/AC18/AC10U AC6 15.03.05.19／AC9 15.03.05.19 (6318)／AC15 15.03.05.19／AC18 15.03.05.19 (6318)／AC10U 15.03.06.48 NULL Pointer Dereference |
|---|
| Description | NULL pointer dereference in the Tenda AC-series web management service (bin/httpd),
function formWifiWpsOOB, reachable at /goform/WifiWpsOOB.
The function retrieves the request parameter "index" through a getter whose default value
is NULL and passes the result directly to atoi() without validating it:
index = websGetVar(wp, "index", NULL);
...
atoi(index); <- dereference, no guard
...
if (index == NULL) { ... } <- the guard exists, 44 bytes later
When "index" is absent or empty the getter returns NULL, and atoi(NULL) descends into the C
library's strtol, whose character-scan loop reads a byte from address 0x0. This raises
SIGSEGV and terminates the service, leaving the web interface unavailable until the device
is restarted. Captured under a debugger: pc 0x3fdedafc inside strtol, r0 = 0x0, faulting
instruction ldrb r3,[r6] with r6 = 0x0, fault address 0x0, caller confirmed by the saved
return address 0x9b724 on the guest stack.
A single unauthenticated request is enough:
curl -s "http://<device>/goform/WifiWpsOOB" -H "Cookie: password=x"
The authentication gate only checks that a cookie named "password" is present and never
validates its value, so no credentials are required.
Affected and reproduced: Tenda AC6 15.03.05.19, AC9 (v1.0) 15.03.05.19 (6318),
AC15 15.03.05.19, AC18 15.03.05.19 (6318), AC10U 15.03.06.48. All five were reproduced by
running the vendor's unmodified firmware images under QEMU user-mode emulation. The AC6
archive is byte-identical to the file the vendor's download centre serves today
(SHA256 621ce4ee...2372aa1b). The vendor was notified on 2026-10-10.
This is a different defect from the stack-based buffer overflows previously reported for the
same function and the same parameter (CWE-121 and related, triggered by an over-long value).
This one is CWE-476, triggered by the parameter being absent. The triggers are mutually
exclusive: supplying a value cannot reach this fault and omitting it cannot reach the
overflow. Across the whole binary there is exactly one unguarded NULL-default parameter
read, while the two sibling handlers that read the same parameter name validate it
correctly, indicating an implementation omission rather than a design choice.
CVSS 3.1: 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
|
|---|
| Source | ⚠️ https://github.com/Xuan-crane/IoT-CVE-Records/blob/main/Tenda/AC6-AC9-AC15-AC18-AC10U/formWifiWpsOOB-null-pointer-dereference.md |
|---|
| User | xucrane (UID 102018) |
|---|
| Submission | 10/10/2026 13:15 (21 days ago) |
|---|
| Moderation | 10/26/2026 17:14 (16 days later) |
|---|
| Status | Duplicate |
|---|
| VulDB entry | 214113 [Tenda AC18 15.03.05.19 formWifiWpsOOB buffer overflow] |
|---|
| Points | 0 |
|---|