Skip to content

Latest commit

 

History

History

10

Folders and files

NameName
Last commit message
Last commit date

parent directory

..
1.png
1.png
 
 
2.png
2.png
 
 
3.png
3.png
 
 
README.md
README.md
 
 
poc.png
poc.png
 
 

README.md

Tenda Router AC Series Vulnerability

This vulnerability lies in the /goform/setWAN page which influences the lastest version of Tenda Router AC11. (AC11_V02.03.01.104_CN)

Vulnerability description

3

There is a stack buffer overflow vulnerability in the wanBasicCfg module.

1

the program reads user input wanIP into variable v9 and uses nvram_set function to set the nvram variable wan0_ipaddr, without porper length check.

2

the prograrm will then use nvram_get function to put that input into variable v51 and copy to a fixed destination, which will cause a stack overflow.

So by POSTing the page /goform/setWAN with proper wanIP, the attacker can easily perform a Deny of Service Attack or Remote Code Execution with carefully crafted overflow data.

POC

poc

Timeline

  • 2022.01.09 report to CVE & CNVD
  • 2022.02.07 CNVD ID assigned: CNVD-2022-08887
  • 2022.02.16 CVE ID assigned: CVE-2021-46265

Acknowledgment

Credit to @cpegg, @leonW7 and @peanuts from Shanghai Jiao Tong University and TIANGONG Team of Legendsec at Qi'anxin Group.