| 标题 | Tenda CH22 V1.0.0.1 Denial of Service |
|---|
| 描述 | A Denial of Service (DoS) vulnerability exists in the CH22 V1.0.0.1 firmware. The vulnerability is located in the fromDhcpListClient function, which handles DHCP static IP settings.
The application retrieves the value of the LISTLEN parameter from the HTTP request and converts it to an integer using atoi to determine the number of iterations for a loop. The code logic is roughly: for ( i = 1; i <= atoi(LISTLEN); ++i ).
However, there is no validation on the upper limit of the LISTLEN parameter. Inside the loop, the application performs resource-intensive operations, including string formatting (sprintf), parameter retrieval (websGetVar), and writing to NVRAM (SetValue).
An unauthenticated remote attacker can exploit this by sending a crafted HTTP POST request with LISTLEN set to an extremely large value (e.g., "1000000"). This forces the device to execute the loop millions of times, causing 100% CPU usage and exhaustion of system resources. This renders the web server (httpd) unresponsive, and typically triggers the system watchdog to reboot the device, resulting in a Denial of Service. |
|---|
| 来源 | ⚠️ https://github.com/master-abc/cve/issues/7 |
|---|
| 用户 | jiefengliang (UID 93721) |
|---|
| 提交 | 2025-12-28 16時49分 (9 月前) |
|---|
| 管理 | 2025-12-29 08時50分 (16 hours later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 338625 [Tenda CH22 直到 1.0.0.1 /goform/DhcpListClient fromDhcpListClient LISTLEN 拒绝服务] |
|---|
| 积分 | 20 |
|---|