Exploitation Summary
EIP tracks 3 public exploits for CVE-2018-5767. PoCs published by Tim Carrington, Scorpion-Security-Labs, db44k.
AI-analyzed exploit summary This exploit targets CVE-2018-5767, a buffer overflow in the web interface of a device, using ROP gadgets to bypass DEP/NX and brute-force ASLR. It delivers a reverse shell via a compiled ARM binary served over HTTP.
Description
An issue was discovered on Tenda AC15 V15.03.1.16_multi devices. A remote, unauthenticated attacker can gain remote code execution on the device with a crafted password parameter for the COOKIE header.
Exploits (3)
This exploit targets CVE-2018-5767, a buffer overflow in the web interface of a device, using ROP gadgets to bypass DEP/NX and brute-force ASLR. It delivers a reverse shell via a compiled ARM binary served over HTTP.
This PoC exploits CVE-2018-5767, a buffer overflow vulnerability in the AC9 router's password parsing logic via the Cookie header. It leverages a ROP chain with hardcoded libc addresses to achieve remote command execution.
This PoC exploits CVE-2018-5767, a buffer overflow vulnerability in the AC9 router model caused by an unguarded sscanf call when parsing the 'Cookie' header. It leverages ROP gadgets and a known libc base address to achieve remote code execution.
References (2)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H