Tenda AC21 Buffer Overflow Vulnerability in SetStaticRouteCfg Function

A buffer overflow vulnerability has been identified in the Tenda AC21 router, affecting firmware versions through 16.03.08.16. The issue arises in the SetStaticRouteCfg function, where the sscanf function is used to parse the 'list' argument without proper bounds checking. This vulnerability can be exploited remotely, leading to a stack overflow that could potentially allow for arbitrary code execution.

Impact

Exploitation of this vulnerability causes a buffer overflow, leading to a stack overflow that can be exploited for arbitrary code execution.

Reproduction

To reproduce this vulnerability, send a crafted HTTP POST request to the '/goform/SetStaticRouteCfg' endpoint. The request must include a 'list' parameter with a value that exceeds the expected length, bypassing the lack of bounds checking in the sscanf function. This can be done using a web application testing tool or script that automates the process of sending HTTP requests.