| 标题 | Tenda AC15 15.03.05.18 Memory Corruption |
|---|
| 描述 | A stack-based buffer overflow exists in the formWifiBasicSet function of the Tenda AC15 router firmware V15.03.05.18. The vulnerability is in the httpd binary which handles HTTP requests on the device. When processing a POST request to /goform/WifiBasicSet, the function reads the "security" and "security_5g" parameters via websGetVar() and copies them into 256-byte stack buffers using strcpy() with no length validation. By sending a parameter value longer than 256 bytes, an attacker can overwrite the saved return address on the stack and hijack program control flow. A full remote code execution exploit has been developed using a ROP chain (pop r3 + mov r0,sp + blx r3) to call libc system() with an attacker-controlled command string, achieving arbitrary command execution as root. The vulnerability requires LAN access and cookie-based authentication (default credentials). Proof of concept and exploit code are included in the attached archive. |
|---|
| 来源 | ⚠️ https://files.catbox.moe/py6j1f.zip |
|---|
| 用户 | meshaal (UID 96796) |
|---|
| 提交 | 2026-03-25 16時19分 (6 月前) |
|---|
| 管理 | 2026-04-08 18時57分 (14 days later) |
|---|
| 状态 | 重复 |
|---|
| VulDB条目 | 206867 [Tenda AC15 15.03.05.18 httpd /goform/formWifiBasicSet 内存损坏] |
|---|
| 积分 | 0 |
|---|