CVE-2023-40838 - Tenda AC6 Router Command Execution Vulnerability in 'sub

A command execution vulnerability (CVE-2023-40838) has been identified in Tenda AC6 routers, specifically in the US_AC6V1.BR_V15.03.05.16_multi_TD01.bin firmware. The affected function is 'sub_3A1D', which under certain conditions, allows an attacker to execute arbitrary commands on the router. This vulnerability puts the security of the connected devices at risk and can potentially lead to unauthorized access and control.

Affected Routers and Firmware

* Tenda AC6 Router
* Firmware version: US_AC6V1.BR_V15.03.05.16_multi_TD01.bin

Vulnerability Details

The vulnerable function 'sub_3A1D' is called when processing certain user inputs. The following code snippet shows how the vulnerability can be triggered:

int sub_3A1D(char *input)
{
    ...
    char cmd[256];
    ...
    snprintf(cmd, 256, "command_here '%s'", input);
    system(cmd);
    ...
}

This code uses the snprintf() function to concatenate the input into an existing command string, without proper sanitization or input validation. As a result, an attacker can craft a malicious input string containing command injection payloads, which would be executed by the system() call.

Exploitation

An attacker can exploit this vulnerability remotely if they have network access to the router, or locally if they have access to the router's administrative web interface. By supplying a malicious input string, the attacker can execute arbitrary commands on the router with root privileges.

Example of a malicious input string

'; telnetd -l /bin/sh -p 12345; #'

In the above example, the attacker injects a command to start a telnet daemon on the router, listening on port 12345 and providing a shell interface.

Mitigation

No official patch is currently available for this vulnerability. Users are advised to monitor the Tenda website for firmware updates and apply them as soon as they become available. Meanwhile, users should restrict access to the router's web interface and disable remote management features if possible.

References

1. CVE-2023-40838 - Information and details about the vulnerability from the CVE database.
2. Tenda's Website - The official website of Tenda, where users can check for product updates and firmware releases.
3. Exploit Database - A repository of exploits and vulnerable software, which may include further information and proof of concept code for this vulnerability.

Conclusion

The command execution vulnerability in the Tenda AC6 router's firmware (US_AC6V1.BR_V15.03.05.16_multi_TD01.bin) is a critical security issue that could allow attackers to gain unauthorized access to the device. Users are encouraged to restrict access to the router's administrative web interface, disable remote management features if possible, and apply firmware updates as soon as they become available. Keep an eye on official communications from Tenda for any updates related to this vulnerability.

Timeline

Published on: 08/30/2023 17:15:10 UTC
Last modified on: 09/01/2023 20:12:42 UTC