CVE-2023-51101

Vulnerability

A stack overflow vulnerability exists in the Tenda W9 router running firmware version V1.0.0.7(4456)_CN. The flaw is located in the formSetUplinkInfo function, reachable via the URL /goform/setUplinkInfo. The function does not properly validate the length of input data, allowing an attacker to overflow the stack buffer when sending a crafted POST request. [1]

Exploitation

An unauthenticated attacker on the same network can exploit this vulnerability by sending a specially crafted HTTP POST request to the /goform/setUplinkInfo endpoint. The published proof-of-concept demonstrates a payload that overwrites the return address and injects shellcode to start a telnet daemon on the router. [1]

Impact

Successful exploitation results in remote code execution as root on the Tenda W9 router. The attacker gains full control over the device, including the ability to modify system configuration, intercept network traffic, and launch further attacks. [1]

Mitigation

Tenda has not released a fixed firmware version as of the publication date (2023-12-26). Users should consider isolating the router from untrusted networks and monitoring for any vendor updates. No workaround is currently available. [1]