A recent vulnerability has been discovered in the Tenda AC18 router, a popular router model operating under firmware version V15.03.05.19. The router is exposed to a buffer overflow vulnerability, which could potentially allow a remote attacker to execute arbitrary code on the device. This blog post will breakdown the vulnerability, designated as CVE-2022-44178, with an explanation of the exploit, code snippets, references to the original research, and more.

Exploit Details

The vulnerability lies in the Tenda AC18 V15.03.05.19 firmware when handling HTTP requests through the formWifiWpsOOB function, used for Wi-Fi and WPS configurations. If a malicious HTTP request is sent with an overly long "ssid" field value, the size of the input may exceed the limited buffer size, eventually leading to a buffer overflow. This could allow remote code execution on the vulnerable router, granting administrative access to the attacker.

Detailed Analysis

The exploit consists of sending a maliciously crafted HTTP request to the target router, containing a payload in the "ssid" field that exceeds an expected length. This can cause a buffer overflow, which could potentially overwrite areas in memory, leading to corruption, instability, or code execution.

Here is a sample payload to understand the exploit better

POST /goform/formWifiWpsOOB HTTP/1.1
Host: <target_IP>
Content-Type: application/x-www-form-urlencoded
Content-Length: <length>

ssid=<long_malicious_ssid>&passphrase=<arbitrary_value>

The long_malicious_ssid value should be crafted in a manner that it triggers the buffer overflow, in device firmware.

Original References

The vulnerability was initially discovered and reported by Karthik Varadarajan, a security researcher. The details of this finding can be found in his original disclosure, following responsible disclosure practices:

- CVE-2022-44178: Tenda AC18 V15.03.05.19 Buffer Overflow

The National Vulnerability Database (NVD) provides a detailed summary, including the CVE's description, impact score, and additional references:

- NVD - CVE-2022-44178

Mitigation and Prevention

Currently, no patch or fix has been released by Tenda for this vulnerability. The risk of exploitation can be minimized by following best practices, including disabling remote management features and ensuring secure access to the router's administration interface.

It is also crucial to monitor and report any suspicious activity on your network, keeping devices and software updated with the latest security patches, and maintaining awareness of potential threats.

Conclusion

The Tenda AC18 router's buffer overflow vulnerability, CVE-2022-44178, highlights the importance of maintaining security alongside functionality in IoT devices, including routers. Regular patching and updating firmware are critical in mitigating these types of vulnerabilities. As always, continue to stay vigilant and up-to-date on emerging threats to protect your devices, data, and networks from potential risks.

Timeline

Published on: 11/21/2022 18:15:00 UTC
Last modified on: 11/28/2022 13:49:00 UTC