# tenda overflow vulnerability

vendor:Tenda

product:G1,G3

version:V15.11.0.17(9502)\_CN(G1), V15.11.0.17(9502)\_CN(G3)

type:Buffer Overflow

author:Jinwen Zhou、Yifeng Li、Yongjie Zheng;

institution:potatso@scnu、feng@scnu、eifiz@scnu

## Vulnerability description

We found a buffer overflow vulnerability in Tenda Technology Tenda's **G1 and G3** routers with firmware which was released recently，allows remote attackers to execute arbitrary code from a crafted GET request.

### Buffer Overflow vulnerability

In **formDelPortMapping** function, the parameter **"portMappingIndex"** is directly **strcpy** to a local variable placed on the stack, which overrides the return address of the function, causing buffer overflow.


## PoC

### Buffer Overflow

We set the value of **portMappingIndex** as **aaaaaaaaaaaaaaaaaaaaaaaaa……** and the router will cause buffer overflow.