Tenda AC18 Stack-Based Buffer Overflow Vulnerability in saveAutoQos Function

A stack-based buffer overflow vulnerability has been identified in the Tenda AC18 router running firmware version 15.03.05.19. The issue arises in the file '/goform/saveAutoQos', where the 'enable' parameter is processed without proper length validation. This vulnerability can be exploited remotely, leading to potential arbitrary code execution.

Impact

Exploitation of this vulnerability causes a stack-based buffer overflow, which can often be leveraged to execute arbitrary code on the device.

Reproduction

The vulnerability can be reproduced by sending a POST request to '/goform/saveAutoQos' with a crafted 'enable' parameter that exceeds the buffer length. After the payload is accepted, the '/goform/getAdvanceStatus' endpoint can be accessed to retrieve the modified status, demonstrating the successful exploitation of the buffer overflow.