Tenda AC10 Buffer Overflow Vulnerability in SysRunCmd Function

A buffer overflow vulnerability has been identified in the Tenda AC10 router running version 16.03.10.13. The issue arises in the formSysRunCmd function within the /goform/SysRunCmd file, where improper handling of the getui argument allows for remote exploitation. This vulnerability has been publicly disclosed and is accompanied by a proof-of-concept exploit.

Impact

Exploitation of this vulnerability leads to a buffer overflow, which can commonly result in arbitrary code execution or causing the device to crash.