CVE-2020-13392: tendacn ac15_firmware Classic Buffer Overflow

Vulnerability summary

CVE-2020-13392 is a critical (CVSS 9.8) Classic Buffer Overflow vulnerability in tendacn ac15_firmware. EPSS estimates a 2.55% chance of exploitation in the next 30 days, higher than 84.9% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 22-05-2020
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

An issue was discovered on Tenda AC6 V1.0 V15.03.05.19_multi_TD01, AC9 V1.0 V15.03.05.19(6318)_CN, AC9 V3.0 V15.03.06.42_multi, AC15 V1.0 V15.03.05.19_multi_TD01, and AC18 V15.03.05.19(6318_)_CN devices. There is a buffer overflow vulnerability in the router's web server -- httpd. While processing the /goform/setcfm funcpara1 parameter for a POST request, a value is directly used in a sprintf to a local variable placed on the stack, which overwrites the return address of a function. An attacker can construct a payload to carry out arbitrary code execution attacks.

• CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.