| Title | Tenda AC18 V15.03.05.19_multi Stack-based Buffer Overflow |
|---|
| Description | Title: Remote Stack-Based Buffer Overflow in Tenda AC18 via Profile Retrieval in sub_34A18 (password)
Description:
A critical stack-based buffer overflow vulnerability was identified in the HTTP server daemon (httpd) of the Tenda AC18 router (firmware version V15.03.05.19_multi).
Vulnerability Mechanism:
The issue arises from an insecure data flow between the fast setting configuration handler and the profile processing subsystem. In the web form handler function form_fast_setting_pppoe_set, an attacker can supply an arbitrarily long payload via the HTTP POST argument password. The application saves this untrusted input directly into the system database under the key wan1.ppoe.pwd.
Subsequently, during internal configuration processing or status retrieval within the sub_34A18 function, the application fetches the stored wan1.ppoe.pwd profile and attempts to write it into a fixed-size stack buffer v12. However, the destination buffer v12 is allocated on the stack with a restricted capacity of only 68 bytes (char v12[68] or equivalent). Because the data retrieval operation is executed without any boundary validation or size verification relative to the target buffer, supplying a profile value longer than 68 bytes triggers an immediate memory overwrite.
Impact:
By submitting a crafted password parameter exceeding 68 bytes in a prior fast setting request, a remote attacker can force a linear stack overflow during the configuration processing phase. The excessive data spills past the boundaries of v12, corrupting adjacent stack memory variables and overwriting the saved return address (Return Address). Consequently, a remote attacker can exploit this vulnerability to induce a persistent Denial of Service (DoS) via httpd daemon crashes or potentially achieve arbitrary remote code execution (RCE) with root privileges.
Exploit/PoC Target Parameter: password (via POST request to /goform/form_fast_setting_pppoe_set) |
|---|
| Source | ⚠️ https://github.com/mz21g/vulnerabilities/tree/main/Tenda/AC18/vuln_9 |
|---|
| User | yanzhichen (UID 98986) |
|---|
| Submission | 06/14/2026 19:32 (1 month ago) |
|---|
| Moderation | 07/20/2026 09:10 (1 month later) |
|---|
| Status | Duplicate |
|---|
| VulDB entry | 327208 [Tenda AC18 15.03.05.19(6318) fast_setting_pppoe_set Username stack-based overflow] |
|---|
| Points | 0 |
|---|