Executive Summary
A stack-based buffer overflow vulnerability has been identified in Tenda G0 up to version 20260625. The vulnerability affects the httpd web management interface and can be exploited remotely by manipulating the staticRouteNet argument in the addStaticRoute function. This vulnerability has a CVSS score of 8.8 and is considered high severity.
Technical Analysis
The vulnerability is classified as a stack-based buffer overflow (CWE-119, CWE-121). The affected component is the httpd web management interface, specifically the addStaticRoute function in the /goform/module file. An attacker can exploit this vulnerability by sending a crafted request to the /goform/module endpoint, manipulating the staticRouteNet argument to exceed the buffer size, leading to a stack-based buffer overflow.
How It Gets Exploited
An unauthenticated remote attacker on the same network can exploit this vulnerability by sending a crafted HTTP request to the /goform/module endpoint, specifically manipulating the staticRouteNet argument in the addStaticRoute function. When the flawed function processes the request, it fails to validate the input length, causing a stack-based buffer overflow that overwrites adjacent memory. This could lead to arbitrary code execution as the web service user, potentially allowing the attacker to pivot to internal systems.
Impact Assessment
The affected product is Tenda G0 up to version 20260625. An attacker can achieve arbitrary code execution, potentially leading to a complete compromise of the system. The CVSS score for this vulnerability is 8.8, indicating a high severity level.
Recommended Actions
To mitigate this vulnerability, update Tenda G0 to version 20260625 or later. Additionally, restrict access to the httpd web management interface to trusted networks and implement network segmentation to limit the attack surface. Monitor network traffic for suspicious requests to the /goform/module endpoint.
Sources
- National Vulnerability Database (NVD)
- Vuldb.com