Tenda AC9 and AC15 Buffer Overflow Vulnerability in the exeCommand Function

A buffer overflow vulnerability has been identified in the Tenda AC9 and AC15 routers, specifically in the firmware versions 15.03.05.14 and 15.03.05.18. The vulnerability arises in the 'formexeCommand' function within the '/goform/exeCommand' file, where the 'cmdinput' parameter is processed. The issue allows remote attackers to manipulate the 'cmdinput' argument, leading to a buffer overflow condition. Exploitation of this vulnerability causes the device to crash.

Impact

Exploitation of this vulnerability leads to a device crash, causing a denial-of-service condition.

Reproduction

The vulnerability can be reproduced by sending a GET request to the '/goform/exeCommand' endpoint with the 'cmdinput' parameter. The parameter value should be a string that exceeds the buffer size, such as 1000 characters of 'a'. This request can be made using a web browser or a tool like cURL or Postman.