Tenda AC18 Stack-Based Buffer Overflow Vulnerability in UPnP Configuration

A stack-based buffer overflow vulnerability has been identified in the Tenda AC18 router, specifically in the firmware version 15.03.05.19(6318). The issue arises in the file '/goform/SetUpnpCfg', where the 'upnpEn' parameter can be manipulated, leading to the overflow. This vulnerability can be exploited remotely, and a public proof-of-concept exploit is available.

Impact

Exploitation of this vulnerability causes a stack-based buffer overflow, which can lead to arbitrary code execution or causing the device to crash.

Reproduction

To reproduce this vulnerability, send a POST request to '/goform/SetUpnpCfg' with a payload that exceeds the buffer limit in the 'upnpEn' parameter. This can be done using a script that automates the process, such as one written in Python that uses the 'requests' library. After the buffer overflow is triggered, the 'upnpEn' parameter can be retrieved through the '/goform/GetAdvanceStatus' endpoint.