Tenda AC6/AC9/AC15/AC118 V15.03.05 httpd saveParentControlInfo deviceId/time buffer overflow

Summaryinfo

A vulnerability was found in Tenda AC6, AC9, AC15 and AC118 V15.03.05. It has been rated as critical. Affected is an unknown function of the file /goform/saveParentControlInfo of the component httpd. The manipulation of the argument deviceId/time as part of POST Request leads to buffer overflow. This vulnerability is documented as CVE-2020-13393. The attack needs to be performed locally. There is not any exploit available.

Detailsinfo

A vulnerability was found in Tenda AC6, AC9, AC15 and AC118 V15.03.05 and classified as critical. This issue affects an unknown function of the file /goform/saveParentControlInfo of the component httpd. The manipulation of the argument deviceId/time as part of a POST Request leads to a buffer overflow vulnerability. Using CWE to declare the problem leads to CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

An issue was discovered on Tenda AC6 V1.0 V15.03.05.19_multi_TD01, AC9 V1.0 V15.03.05.19(6318)_CN, AC9 V3.0 V15.03.06.42_multi, AC15 V1.0 V15.03.05.19_multi_TD01, and AC18 V15.03.05.19(6318_)_CN devices. There is a buffer overflow vulnerability in the router's web server -- httpd. While processing the /goform/saveParentControlInfo deviceId and time parameters for a POST request, a value is directly used in a strcpy to a local variable placed on the stack, which overwrites the return address of a function. An attacker can construct a payload to carry out arbitrary code execution attacks.

The weakness was released 05/22/2020. The identification of this vulnerability is CVE-2020-13393 since 05/22/2020. An attack has to be approached locally. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Entries connected to this vulnerability are available at VDB-155562, VDB-155560, VDB-155559 and VDB-155558. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• Tenda

Name

• AC6
• AC9
• AC15
• AC118

Version

• V15.03.05

License

• commercial

Website

• Vendor: https://www.tenda.com.cn/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Duplicate

• Submit #XXXXXX: Xxxxx Xxxx Xxx.xx.xx.xx Xxxxxx Xxxxxxxx (by wxhwxhwxh_miemie)
• Submit #XXXXXX: Xxxxx Xxxx Xxx.xx.xx.xx Xxxxxx Xxxxxxxx (by wxhwxhwxh_miemie)
• Submit #XXXXXX: Xxxxx Xxxx Xx.x Xxx.xx.xx_xxxxx Xxxxxx Xxxxxxxx (by wxhwxhwxh_miemie)
• Submit #XXXXXX: Xxxxx Xxxx Xx.x Xxx.xx.xx_xxxxx Xxxxxx Xxxxxxxx (by wxhwxhwxh_miemie)

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion