| tiêu đề | Tenda AC5 V02.03.01.111_multi Buffer Overflow |
|---|
| Mô tả | A stack-based buffer overflow exists in the setWifi handler of Tenda AC5 v3 (firmware V02.03.01.111_multi), reachable via the wifiPwd parameter of the /goform/setWifi endpoint. An authenticated attacker can submit an oversized wifiPwd value that is copied into a fixed-size buffer without length validation, resulting in memory corruption and direct control of the program counter (PC register overwritten to 0x41414141, confirmed via crash dump). The overflow additionally corrupts the device's NVRAM configuration store, overwriting the wl0_wpa_psk key and surrounding entries, causing the device to crash on every subsequent boot as it re-parses the malformed configuration block — a persistent denial-of-service surviving reboot, not just a transient crash. |
|---|
| Nguồn | ⚠️ https://github.com/raisecnull/Tenda-AC5v3-BOF/blob/main/blog.md |
|---|
| Người dùng | raisecnull (UID 101471) |
|---|
| Đệ trình | 20/09/2026 15:44 (cách đây 16 ngày) |
|---|
| Kiểm duyệt | 05/10/2026 22:35 (15 days later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 413811 [Tenda AC5 02.03.01.111_multi Wifi /goform/setWifi wifiPwd tràn bộ đệm] |
|---|
| điểm | 20 |
|---|