Tenda W12 Stack-Based Buffer Overflow Vulnerability in WiFi MAC Filter Function

A stack-based buffer overflow vulnerability has been identified in the Tenda W12 access point running firmware version 3.0.0.6(3948). The issue arises in the HTTP request handler, specifically within the 'wifiMacFilterSet' function, located in the '/goform/modules' file. This vulnerability can be exploited remotely by sending malformed HTTP requests that manipulate the 'mac' argument, leading to arbitrary code execution or causing denial-of-service conditions.

Impact

Exploitation of this vulnerability allows for arbitrary code execution or the introduction of denial-of-service conditions on the device.

Reproduction

The vulnerability can be reproduced by sending a POST request to the '/goform/modules' endpoint with a JSON payload that includes an oversized 'mac' value in the 'macList' array. The 'mac' value can be crafted to exceed the buffer size, causing a stack-based overflow. This can be done using a Python script that utilizes the 'requests' library to send the payload.