changed 4 years ago  
Linked with GitHub

tenda overflow vulnerability

vendor:Tenda

product:G1,G3

version:V15.11.0.17(9502)_CN(G1), V15.11.0.17(9502)_CN(G3)

type:Buffer Overflow

author:Jinwen Zhou、Yifeng Li、Yongjie Zheng;

institution:potatso@scnu、feng@scnu、eifiz@scnu

Vulnerability description

We found a buffer overflow vulnerability in Tenda Technology Tenda's G1 and G3 routers with firmware which was released recently，allows remote attackers to execute arbitrary code from a crafted GET request.

Buffer Overflow vulnerability

In formDelPortMapping function, the parameter "portMappingIndex" is directly strcpy to a local variable placed on the stack, which overrides the return address of the function, causing buffer overflow.

PoC

Buffer Overflow

We set the value of portMappingIndex as aaaaaaaaaaaaaaaaaaaaaaaaa…… and the router will cause buffer overflow.

Select a repo