Gửi #883728: Tenda AC15 US_AC15V1.0BR_V15.03.05.19_multi_TD01 Stack-based Buffer Overflow

Tenda AC15 firmware US_AC15V1.0BR_V15.03.05.19_multi_TD01 contains a stack-based buffer overflow in the web management service httpd, specifically in the GoAhead-based /goform request handling path. The issue is observable when the device processes an HTTP POST request for the handler /goform/WifiBasicSet. The vulnerable behavior is triggered by supplying an oversized POST body to the affected handler. According to the current crash material, the request body is copied into a stack-resident buffer without sufficient length validation, allowing attacker-controlled data to overwrite adjacent stack memory, including saved control-flow state.

The current proof material shows that body data of about 98 bytes or more is sufficient to enter the corrupting state, while a body of 128 bytes consisting entirely of the character 'A' is enough to produce a characteristic crash pattern. On the ARM target, the overwritten return state is reflected as the Thumb-mode program counter value pc=0x81414141. This value is significant because 0x41414141 corresponds to the repeated attacker-controlled byte sequence 'AAAA', and 0x81414141 represents the same pattern interpreted in ARM Thumb control-flow context. This strongly indicates that user-supplied request data reaches and overwrites saved return control data on the stack.

The vulnerable component is the web administration interface, so the immediate security consequence is denial of service of the management service httpd. Depending on the exact reachability of the handler, deployed authentication configuration, compiler protections, and runtime mitigations, the bug may also present a risk of further control-flow hijacking rather than only service interruption. At minimum, a remote attacker capable of reaching the management interface can crash the service by sending a crafted oversized POST request to the affected goform endpoint.

The issue is particularly important because /goform handlers are part of the router's administrative web interface and are commonly exposed to the local network. Existing PoC material associates the bug with /goform/WifiBasicSet and further suggests the unsafe body-handling logic may be shared by multiple write-oriented /goform handlers. Even if later triage narrows the issue to one endpoint, the observed crash signature is already sufficient to classify the bug as a stack-based memory corruption vulnerability in the HTTP management plane.

• Nguồn: ⚠️ https://gist.github.com/wyxstarry/96202beb267138cd1bd6843b2a8ce79d
• Người dùng: yuxin_wang (UID 98928)
• Đệ trình: 09/07/2026 03:08 (cách đây 2 các tháng)
• Kiểm duyệt: 23/08/2026 15:58 (2 months later)
• Trạng thái: Bản sao
• Mục VulDB: 206867 [Tenda AC15 15.03.05.18 httpd /goform/formWifiBasicSet tràn bộ đệm]
• điểm: 0