| 标题 | Tenda AC5 V02.03.01.111_multi Buffer Overflow |
|---|
| 描述 | A stack-based buffer overflow exists in the setWifi handler of Tenda AC5 v3 (firmware V02.03.01.111_multi), reachable via the wifiPwd parameter of the /goform/setWifi endpoint. An authenticated attacker can submit an oversized wifiPwd value that is copied into a fixed-size buffer without length validation, resulting in memory corruption and direct control of the program counter (PC register overwritten to 0x41414141, confirmed via crash dump). The overflow additionally corrupts the device's NVRAM configuration store, overwriting the wl0_wpa_psk key and surrounding entries, causing the device to crash on every subsequent boot as it re-parses the malformed configuration block — a persistent denial-of-service surviving reboot, not just a transient crash. |
|---|
| 来源 | ⚠️ https://github.com/raisecnull/Tenda-AC5v3-BOF/blob/main/blog.md |
|---|
| 用户 | raisecnull (UID 101471) |
|---|
| 提交 | 2026-09-20 15時44分 (16 日前) |
|---|
| 管理 | 2026-10-05 22時35分 (15 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 413811 [Tenda AC5 02.03.01.111_multi Wifi /goform/setWifi wifiPwd 内存损坏] |
|---|
| 积分 | 20 |
|---|