tenda overflow vulnerability

# tenda overflow vulnerability vendor:Tenda product:G1,G3 version:V15.11.0.17(9502)\_CN(G1), V15.11.0.17(9502)\_CN(G3) type:Buffer Overflow author:Jinwen Zhou、Yifeng Li、Yongjie Zheng; institution:potatso@scnu、feng@scnu、eifiz@scnu ## Vulnerability description We found a buffer overflow vulnerability in Tenda Technology Tenda's **G1 and G3** routers with firmware which was released recently，allows remote attackers to execute arbitrary code from a crafted GET request. ### Buffer Overflow vulnerability In **formDelPortMapping** function, the parameter **"portMappingIndex"** is directly **strcpy** to a local variable placed on the stack, which overrides the return address of the function, causing buffer overflow. ![](https://i.imgur.com/E9u1Kpd.png) ## PoC ### Buffer Overflow We set the value of **portMappingIndex** as **aaaaaaaaaaaaaaaaaaaaaaaaa……** and the router will cause buffer overflow.

Cheatsheet

Syntax	Example	Reference
# Header	Header	基本排版
- Unordered List	Unordered List
1. Ordered List	Ordered List
- [ ] Todo List	Todo List
> Blockquote	Blockquote
Bold font	Bold font
Italics font	Italics font
~~Strikethrough~~	~~Strikethrough~~
19^th^	19^th
H~2~O	H₂O
++Inserted text++	Inserted text
==Marked text==	Marked text
[link text](https:// "title")	Link
![image alt](https:// "title")	Image
`Code`	`Code`	在筆記中貼入程式碼
```javascript var i = 0; ```	`var i = 0;`	在筆記中貼入程式碼
:smile:		Emoji list
{%youtube youtube_id %}	Externals
$L^aT_eX$	L^aT_eX
:::info This is a alert area. :::	This is a alert area.