| Title | Tenda AC18 V15.03.05.19_multi Stack-based Buffer Overflow |
|---|
| Description | Title: Remote Stack-Based Buffer Overflow in Tenda AC18 via Profile Retrieval in form_fast_setting_get (PPPOEName)
Description:
A critical stack-based buffer overflow vulnerability was identified in the HTTP server daemon (httpd) of the Tenda AC18 router (firmware version V15.03.05.19_multi).
Vulnerability Mechanism:
The issue arises from an insecure data flow between the quick setup configuration handler and the profile retrieval subsystem. In the web form handler function formQuickIndex, an attacker can supply an arbitrarily long payload via the HTTP POST argument PPPOEName. The application saves this untrusted input directly into the system database under the key wan1.ppoe.userid.
Subsequently, when the fast setting status is queried via the form_fast_setting_get function, the application fetches the stored wan1.ppoe.userid profile and attempts to write it into a fixed-size stack buffer s. However, the destination buffer s is allocated on the stack with a restricted capacity of only 256 bytes (char s[256]). Because the data retrieval function operates without boundary validation or size verification relative to the target buffer, supplying a profile value longer than 256 bytes triggers an immediate memory overwrite.
Impact:
By submitting a crafted PPPOEName parameter exceeding 256 bytes in a prior quick setup request, a remote attacker can force a linear stack overflow during the configuration retrieval phase. The excessive data spills past the boundaries of s, corrupting adjacent stack memory variables and seamlessly overwriting the saved return address (Return Address). Consequently, a remote attacker can exploit this vulnerability to induce a persistent Denial of Service (DoS) via httpd daemon crashes or potentially achieve arbitrary remote code execution (RCE) with root privileges.
Exploit/PoC Target Parameter: PPPOEName (via POST request to /goform/formQuickIndex) |
|---|
| Source | ⚠️ https://github.com/mz21g/vulnerabilities/tree/main/Tenda/AC18/vuln_7 |
|---|
| User | yanzhichen (UID 98986) |
|---|
| Submission | 06/14/2026 19:28 (1 month ago) |
|---|
| Moderation | 07/20/2026 09:10 (1 month later) |
|---|
| Status | Duplicate |
|---|
| VulDB entry | 256893 [Tenda AC18 15.03.05.05 /goform/QuickIndex formQuickIndex PPPOEPassword stack-based overflow] |
|---|
| Points | 0 |
|---|