Tenda AC20 vulnerabilities

A vulnerability was identified in Tenda AC20 16.03.08.12. The affected element is the function formSetPPTPUserList of the file /goform/setPptpUserList of the component httpd. Manipulation of the argument list leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used.

Tenda AC20 up to 16.03.08.12 is affected by a buffer overflow in an unknown function of /goform/WifiExtraSet via manipulation of the wpapsk_crypto argument. The attack can be launched remotely and a public exploit exists.

A buffer overflow vulnerability exists in Tenda AC20 up to version 16.03.08.12 in the sscanf function of /goform/fast_setting_wifi_set. Manipulation of the timeZone argument allows remote attacks, and the exploit has been publicly disclosed.

Tenda AC20 up to version 16.03.08.12 has a buffer overflow vulnerability in the strcpy function in the file /goform/SetPptpServerCfg, where the startIp argument can be manipulated. The attack can be launched remotely, and the exploit is publicly available.

A weakness has been identified in Tenda AC20 16.03.08.05. This vulnerability affects unknown code of the file /goform/fromAdvSetMacMtuWan. Manipulation of the wanMTU argument causes a stack-based buffer overflow. Remote exploitation is possible and the exploit has been made public.