Stack-Based Buffer Overflow in Tenda G0 Router

Executive Summary

This is a stack-based buffer overflow vulnerability in the Tenda G0 router's HTTPD web management interface. The issue occurs in the addStaticRoute function when processing the staticRouteNet argument. A crafted input can overflow a fixed-size stack buffer due to lack of length validation in sprintf, potentially allowing remote code execution or denial of service.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Tenda G0 router is running firmware up to 20260625. Inspect the HTTPD web management interface for the function addStaticRoute in /goform/module. Look for unusual network traffic or crashes related to the staticRouteNet parameter. No specific commands are provided in the context.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to execute arbitrary code on the router, gain control of the device, or cause it to crash. Since the attack is remote and exploits a public exploit, unpatched devices are at high risk of compromise.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially lead to unauthorized access or data breaches due to arbitrary code execution or denial of service, which may violate data protection requirements under GDPR or HIPAA if sensitive data is exposed or compromised.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the Tenda G0 router firmware to a version beyond 20260625. Disable remote access to the HTTPD web management interface if not required. Monitor network traffic for suspicious activity targeting the staticRouteNet parameter. Apply network segmentation to limit exposure.

Useful 0 Not Useful 0