CVE-2018-18730 - OpenCVE

An issue was discovered on Tenda AC7 V15.03.06.44_CN, AC9 V15.03.05.19(6318)_CN, AC10 V15.03.06.23_CN, AC15 V15.03.05.19_CN, and AC18 V15.03.05.19(6318)_CN devices. There is a buffer overflow vulnerability in the router's web server -- httpd. While processing the 'startIp' and 'endIp' parameters for a post request, each value is directly used in a sprintf to a local variable placed on the stack, which overrides the return address of the function.

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact None

Availability Impact Complete

AV:N/AC:L/Au:N/C:N/I:N/A:C

Vendors & Products
CPE Configurations

Vendors	Products
Tenda	Ac10 Ac15 Ac9 Firmware Ac9 Ac18 Firmware Ac7 Firmware Ac18 Ac10 Firmware Ac15 Firmware Ac7

Configuration 1 [-]

AND

cpe:2.3:o:tenda:ac7_firmware:15.03.06.44_cn:*:*:*:*:*:*:*

cpe:2.3:h:tenda:ac7:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:tenda:ac9_firmware:15.03.05.19\(6318\)_cn:*:*:*:*:*:*:*

cpe:2.3:h:tenda:ac9:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:tenda:ac10_firmware:15.03.06.23_cn:*:*:*:*:*:*:*

cpe:2.3:h:tenda:ac10:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:o:tenda:ac15_firmware:15.03.05.19_cn:*:*:*:*:*:*:*

cpe:2.3:h:tenda:ac15:-:*:*:*:*:*:*:*

Configuration 5 [-]

AND

cpe:2.3:o:tenda:ac18_firmware:15.03.05.19\(6318\)_cn:*:*:*:*:*:*:*

cpe:2.3:h:tenda:ac18:-:*:*:*:*:*:*:*

References

Link	Resource
https://github.com/ZIllR0/Routers/blob/master/Tenda/stack3.md	Exploit Third Party Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: mitre

Published: 2018-10-28T00:00:00

Updated: 2018-10-28T00:57:01

Reserved: 2018-10-27T00:00:00

Link: CVE-2018-18730

JSON object: View

NVD Information

Status : Analyzed

Published: 2018-10-29T12:29:07.727

Modified: 2018-12-14T15:37:52.763

Link: CVE-2018-18730

JSON object: View

Redhat Information

No data.

CWE

CWE-119

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2018-10-27T00:00:00", "descriptions": [{"lang": "en", "value": "An issue was discovered on Tenda AC7 V15.03.06.44_CN, AC9 V15.03.05.19(6318)_CN, AC10 V15.03.06.23_CN, AC15 V15.03.05.19_CN, and AC18 V15.03.05.19(6318)_CN devices. There is a buffer overflow vulnerability in the router's web server -- httpd. While processing the 'startIp' and 'endIp' parameters for a post request, each value is directly used in a sprintf to a local variable placed on the stack, which overrides the return address of the function."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-28T00:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://github.com/ZIllR0/Routers/blob/master/Tenda/stack3.md"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2018-18730", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "An issue was discovered on Tenda AC7 V15.03.06.44_CN, AC9 V15.03.05.19(6318)_CN, AC10 V15.03.06.23_CN, AC15 V15.03.05.19_CN, and AC18 V15.03.05.19(6318)_CN devices. There is a buffer overflow vulnerability in the router's web server -- httpd. While processing the 'startIp' and 'endIp' parameters for a post request, each value is directly used in a sprintf to a local variable placed on the stack, which overrides the return address of the function."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://github.com/ZIllR0/Routers/blob/master/Tenda/stack3.md", "refsource": "MISC", "url": "https://github.com/ZIllR0/Routers/blob/master/Tenda/stack3.md"}]}}}}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2018-18730", "datePublished": "2018-10-28T00:00:00", "dateReserved": "2018-10-27T00:00:00", "dateUpdated": "2018-10-28T00:57:01", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:tenda:ac7_firmware:15.03.06.44_cn:*:*:*:*:*:*:*", "matchCriteriaId": "EA048307-E3FA-4868-81E2-489CBCD6D27F", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:tenda:ac7:-:*:*:*:*:*:*:*", "matchCriteriaId": "A3BEE979-5BF3-48ED-AF42-0546D4F896E9", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:tenda:ac9_firmware:15.03.05.19\\(6318\\)_cn:*:*:*:*:*:*:*", "matchCriteriaId": "D433B9D2-8F7E-45B7-99EF-50E96B14B324", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:tenda:ac9:-:*:*:*:*:*:*:*", "matchCriteriaId": "2FD1430E-DC2E-4042-9389-1FD90ECDBE4D", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:tenda:ac10_firmware:15.03.06.23_cn:*:*:*:*:*:*:*", "matchCriteriaId": "39FE2B83-C4C4-4A4B-9F40-A6E340F067A7", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:tenda:ac10:-:*:*:*:*:*:*:*", "matchCriteriaId": "B9E0489C-31D5-43C4-B15D-1D88119EF226", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:tenda:ac15_firmware:15.03.05.19_cn:*:*:*:*:*:*:*", "matchCriteriaId": "A7FDBF96-9556-4B5C-ADBD-ED5E83557159", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:tenda:ac15:-:*:*:*:*:*:*:*", "matchCriteriaId": "B73E7C1C-F121-486A-8B15-E97EA0C219A5", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:tenda:ac18_firmware:15.03.05.19\\(6318\\)_cn:*:*:*:*:*:*:*", "matchCriteriaId": "9AA6A0CA-46AB-4C6F-B4F8-8F3A4D9A71F5", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:tenda:ac18:-:*:*:*:*:*:*:*", "matchCriteriaId": "CF9F8AF9-F921-4348-922B-EE5E6037E7AC", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "An issue was discovered on Tenda AC7 V15.03.06.44_CN, AC9 V15.03.05.19(6318)_CN, AC10 V15.03.06.23_CN, AC15 V15.03.05.19_CN, and AC18 V15.03.05.19(6318)_CN devices. There is a buffer overflow vulnerability in the router's web server -- httpd. While processing the 'startIp' and 'endIp' parameters for a post request, each value is directly used in a sprintf to a local variable placed on the stack, which overrides the return address of the function."}, {"lang": "es", "value": "Se ha descubierto un problema en dispositivos Tenda AC7 V15.03.06.44_CN, AC9 V15.03.05.19(6318)_CN, AC10 V15.03.06.23_CN, AC15 V15.03.05.19_CN y AC18 V15.03.05.19(6318)_CN. Es una vulnerabilidad de desbordamiento de b\u00fafer en el servidor web del router, httpd. Al procesar los par\u00e1metros startIp y endIp para una petici\u00f3n POST, cada valor se emplea directamente en una llamada sprintf a una variable local colocada en la pila, que sobrescribe la direcci\u00f3n de retorno de la funci\u00f3n."}], "id": "CVE-2018-18730", "lastModified": "2018-12-14T15:37:52.763", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.8, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-10-29T12:29:07.727", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/ZIllR0/Routers/blob/master/Tenda/stack3.md"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-119"}], "source": "nvd@nist.gov", "type": "Primary"}]}