tenda overflow vulnerability

vendor:Tenda

product:G1,G3

version:V15.11.0.17(9502)_CN(G1), V15.11.0.17(9502)_CN(G3)

type:Buffer Overflow

author:Jinwen Zhou、Yifeng Li、Yongjie Zheng;

institution:potatso@scnu、feng@scnu、eifiz@scnu

Vulnerability description

We found a buffer overflow vulnerability in Tenda Technology Tenda's G1 and G3 routers with firmware which was released recently，allows remote attackers to execute arbitrary code from a crafted GET request.

Buffer Overflow vulnerability

In formIPMacBindDel function, the parameter "IPMacBindIndex" is directly strcpy to a local variable placed on the stack, which overrides the return address of the function, causing buffer overflow.

PoC

Buffer Overflow

We set the value of IPMacBindIndex as aaaaaaaaaaaaaaaaaaaaaaaaa…… and the router will cause buffer overflow.

Select a repo