Tenda AC15 vulnerabilities

A weakness was identified in Tenda AC15 firmware version 15.03.05.19 in the Samba component. Manipulation of the /etc_ro/smb.conf file leads to weak password requirements. The attack is only possible within the local network, has high complexity, and is difficult to exploit, but the exploit is publicly available.

In Tenda AC15 version 15.03.05.18, the function websGetVar in /goform/SysToolChangePwd is vulnerable to stack-based buffer overflow via manipulation of arguments oldPwd/newPwd/cfmPwd. The attack can be executed remotely, and the exploit is publicly available.

A stack-based buffer overflow vulnerability was identified in Tenda AC15 version 15.03.05.18. Manipulation of the newVersion argument in /goform/setNotUpgrade allows remote attacks, and the exploit is publicly available.

A stack-based buffer overflow vulnerability was determined in Tenda AC15 version 15.03.05.18. Manipulation of the Password argument in /goform/fast_setting_pppoe_set allows remote attacks, and the exploit has been publicly disclosed.

A stack-based buffer overflow vulnerability was found in Tenda AC15 version 15.03.05.18. Manipulation of the ddnsEn argument in /goform/SetDDNSCfg allows remote attacks, and the exploit has been publicly disclosed.

A stack overflow vulnerability exists in the Tenda AC15 router firmware version 15.03.05.19_multi_TD01 in the fromSetIpMacBind function via the list parameter. An attacker can remotely crash the device or potentially execute arbitrary code.