tenda overflow vulnerability

# tenda overflow vulnerability vendor:Tenda product:G1,G3 version:V15.11.0.17(9502)\_CN(G1), V15.11.0.17(9502)\_CN(G3) type:Buffer Overflow author:Jinwen Zhou、Yifeng Li、Yongjie Zheng; institution:potatso@scnu、feng@scnu、eifiz@scnu ## Vulnerability description We found a buffer overflow vulnerability in Tenda Technology Tenda's **G1 and G3** routers with firmware which was released recently，allows remote attackers to execute arbitrary code from a crafted GET request. ### Buffer Overflow vulnerability In **formDelPortMapping** function, the parameter **"portMappingIndex"** is directly **strcpy** to a local variable placed on the stack, which overrides the return address of the function, causing buffer overflow. ![](https://i.imgur.com/E9u1Kpd.png) ## PoC ### Buffer Overflow We set the value of **portMappingIndex** as **aaaaaaaaaaaaaaaaaaaaaaaaa……** and the router will cause buffer overflow.

Example	Syntax
Header	# Header
Unordered List	- Unordered List
Ordered List	1. Ordered List
Todo List	- [ ] Todo List
Blockquote	> Blockquote
Bold font	Bold font
Italics font	Italics font
~~Strikethrough~~	~~Strikethrough~~
19^th	19^th^
H₂O	H~2~O
Inserted text	++Inserted text++
Marked text	==Marked text==
Link	[link text](https:// "title")
Image	![image alt](https:// "title")
`Code`	`Code`
`var i = 0;`	```javascript var i = 0; ```
	:smile:
Externals	{%youtube youtube_id %}
L^aT_eX	$L^aT_eX$
This is a alert area.	:::info This is a alert area. :::