Tenda O3 Stack-Based Buffer Overflow Vulnerability

A stack-based buffer overflow vulnerability has been identified in the Tenda O3 router, specifically in the firmware version 1.0.0.10(2478). The issue arises in the '/goform/setDhcpConfig' endpoint, where the 'dhcpEn' parameter is accepted without proper length or content validation. This vulnerability can be exploited remotely, leading to potential arbitrary code execution.

Impact

Exploitation of this vulnerability causes a stack-based buffer overflow, which can lead to arbitrary code execution.

Reproduction

To reproduce this vulnerability, send a POST request to the '/goform/setDhcpConfig' endpoint with a 'dhcpEn' parameter containing a payload of excessive length. This unvalidated input is then stored and retrieved via the '/goform/getDhcpConfig' endpoint, where the overflow occurs on the stack.