Executive Summary

This vulnerability exists in the Tenda AC6 and AC10U devices, specifically in the fromSetWirelessRepeat function of the httpd component. It involves improper handling of input parameters such as mac and ssid, which allows an attacker to perform OS command injection remotely. This means that an attacker can manipulate these inputs to execute arbitrary commands on the device.

Additionally, for the Tenda AC10U device, a related stack overflow vulnerability occurs because the wpapsk_crypto parameter is copied without length validation, potentially leading to memory corruption.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows remote attackers to execute arbitrary operating system commands on affected Tenda devices. This can lead to unauthorized control over the device, potentially allowing attackers to disrupt network operations, steal sensitive information, or use the device as a foothold for further attacks within the network.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by sending a specially crafted request to the vulnerable endpoint /goform/WifiExtraSet targeting the fromSetWirelessRepeat function. A proof-of-concept involves sending a payload with an excessively long string (e.g., 0x500 'a' characters) in parameters such as wpapsk_crypto to trigger the stack overflow.

You can use tools like curl or similar HTTP request utilities to test the endpoint. For example, a command might look like:

• curl -X POST http://[router_ip]/goform/WifiExtraSet -d "wpapsk_crypto=$(python3 -c 'print("a"*1280)')"

Monitoring network traffic for unusual or malformed requests to /goform/WifiExtraSet can also help detect exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

Since no official patch has been released by the vendor yet, immediate mitigation steps include:

• Restrict remote access to the router's management interface to trusted networks only.
• Disable remote management features if not needed.
• Monitor the vendor's official website for firmware updates addressing this vulnerability.
• Implement network-level protections such as firewall rules to block suspicious requests targeting /goform/WifiExtraSet.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify how this vulnerability impacts compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0