Tenda AC6/AC9/AC15/AC118 V15.03.05 httpd /goform/setcfm funcpara1 buffer overflow

Summaryinfo

A vulnerability was found in Tenda AC6, AC9, AC15 and AC118 V15.03.05. It has been declared as critical. This impacts an unknown function of the file /goform/setcfm of the component httpd. Executing a manipulation of the argument funcpara1 as part of POST Request can lead to buffer overflow. This vulnerability is registered as CVE-2020-13392. The attack needs to be launched locally. No exploit is available.

Detailsinfo

A vulnerability has been found in Tenda AC6, AC9, AC15 and AC118 V15.03.05 and classified as critical. This vulnerability affects some unknown processing of the file /goform/setcfm of the component httpd. The manipulation of the argument funcpara1 as part of a POST Request leads to a buffer overflow vulnerability. The CWE definition for the vulnerability is CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

An issue was discovered on Tenda AC6 V1.0 V15.03.05.19_multi_TD01, AC9 V1.0 V15.03.05.19(6318)_CN, AC9 V3.0 V15.03.06.42_multi, AC15 V1.0 V15.03.05.19_multi_TD01, and AC18 V15.03.05.19(6318_)_CN devices. There is a buffer overflow vulnerability in the router's web server -- httpd. While processing the /goform/setcfm funcpara1 parameter for a POST request, a value is directly used in a sprintf to a local variable placed on the stack, which overwrites the return address of a function. An attacker can construct a payload to carry out arbitrary code execution attacks.

The weakness was published 05/22/2020. This vulnerability was named CVE-2020-13392 since 05/22/2020. The attack needs to be approached locally. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Similar entries are available at VDB-155562, VDB-155561, VDB-155559 and VDB-155558. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Router Operating System

Vendor

• Tenda

Name

• AC6
• AC9
• AC15
• AC118

Version

• V15.03.05

License

• commercial

Website

• Vendor: https://www.tenda.com.cn/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Duplicate

• Submit #XXXXXX: Xxxxx Xxxx Xxx.xx.xx.xx Xxxxxx Xxxxxxxx (by yhryhryhr_backup)

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion