Tenda AC8 Router Stack Buffer Overflow in fast_setting_wifi_set Interface

Key Information Summary Target Information Device: Tenda AC8 Firmware Version: V16.03.33.05 Vendor Website: https://www.tendacn.com Firmware Reference: AC8v4.0 Firmware - Tenda Global (English) Vulnerability Type Vulnerability Type: Stack-based Buffer Overflow Vulnerability Summary This buffer overflow vulnerability exists in the Tenda AC8 router running firmware version V16.03.33.05. The flaw stems from the embedded service's interface, which fails to properly validate the user-supplied parameter. An attacker can exploit this vulnerability by sending a specially crafted HTTP request containing an excessively long value, potentially leading to remote code execution or a denial-of-service (DoS) condition. Vulnerability Description The Tenda AC8 router, in firmware version V16.03.33.05, is affected by a buffer overflow vulnerability. The issue lies in the endpoint, where the service does not adequately filter or validate the length of the parameter. Due to insufficient input validation, a remote attacker can trigger memory corruption by supplying an overly long string. This may result in arbitrary code execution or cause the device to crash. Vulnerability Analysis Using IDA Pro, the vulnerability can be observed in the function within the binary. At line 89, this function calls the vulnerable subroutine . Further analysis of reveals unsafe string parsing and copying operations. The function directly retrieves the parameter from the HTTP request. This parameter is fully controlled by the user and is subject to no length or content validation constraints. The following code is then executed: Here, the input is parsed into local stack buffers and , each of which is only 4 bytes in size. Since the format string imposes no width limits, an overly long parameter will cause a buffer overflow, leading to stack corruption. Attackers can exploit this vulnerability via API requests, malicious configuration files, or crafted HTTP payloads, potentially resulting in a program crash or arbitrary code execution. POC (Proof of Concept) The following test code demonstrates how to trigger the vulnerability: Expected Result Executing this exploit triggers a , indicating that the program attempted to access an invalid memory address. This confirms the presence of a severe memory safety issue.

Goal Reached Thanks to every supporter — we hit 100%!

Tenda AC8 Router Stack Buffer Overflow in fast_setting_wifi_set Interface

More from this source