| 标题 | Tenda AC18 V15.03.05.19_multi Stack-based Buffer Overflow |
|---|
| 描述 | Title: Remote Stack-Based Buffer Overflow in Tenda AC18 via sprintf Counter Overwrite in formWifiMacFilterSet
Description:
A critical stack-based buffer overflow vulnerability was identified in the HTTP server daemon (httpd) of the Tenda AC18 router (firmware version V15.03.05.19_multi).
Vulnerability Mechanism:
The issue exists within the web form handler function formWifiMacFilterSet, which processes wireless MAC address filtering configurations. When a user submits an HTTP POST request containing the filter_list parameter, the application attempts to parse and tokenize a sequence of tilde-separated (~) MAC addresses inside a processing loop.
During each iteration, an incremental counter v23 keeps track of the total number of parsed MAC addresses, and its integer value is formatted into a fixed-size stack buffer v11 using the unsafe sprintf(v11, "%d", v23) function. Crucially, the buffer v11 is allocated with only 4 bytes of capacity (char v11[4]). If an attacker supplies a crafted filter_list payload containing more than 1,000 MAC addresses, the formatted counter string (e.g., "1000", which requires 5 bytes including the null terminator) exceeds the boundary of v11.
Impact:
Due to the lack of boundary or iteration limits on the input tokens, the multi-byte string serialization forces sprintf to perform an unrestricted linear overwrite on the adjacent memory space of the stack frame. This memory corruption destabilizes the local variables and subverts the saved return address, allowing a remote attacker to induce a persistent Denial of Service (DoS) via httpd daemon crashes, or potentially leverage the register state to achieve arbitrary remote code execution (RCE) with root privileges.
Exploit/PoC Target Parameter: filter_list (via POST request to /goform/WifiMacFilterSet) |
|---|
| 来源 | ⚠️ https://github.com/mz21g/vulnerabilities/tree/main/Tenda/AC18/vuln_5 |
|---|
| 用户 | yanzhichen (UID 98986) |
|---|
| 提交 | 2026-06-14 19時24分 (4 月前) |
|---|
| 管理 | 2026-07-20 09時09分 (1 month later) |
|---|
| 状态 | 重复 |
|---|
| VulDB条目 | 327209 [Tenda AC18 15.03.05.19(6318) /goform/WifiMacFilterSet wifi_chkHz 内存损坏] |
|---|
| 积分 | 0 |
|---|