Tenda AC20 Buffer Overflow Vulnerability in WifiExtraSet Function

A buffer overflow vulnerability has been identified in the Tenda AC20 router, affecting firmware versions through 16.03.08.12. The vulnerability arises in the WifiExtraSet function, where the wpapsk_crypto argument can be manipulated, leading to a stack overflow. This issue can be exploited remotely, causing a denial-of-service condition or potentially allowing for remote code execution.

Impact

Exploitation of this vulnerability causes a denial-of-service condition, with the router crashing and services becoming unavailable. Additionally, this vulnerability allows for remote code execution on the affected device.

Reproduction

To reproduce this vulnerability, send a crafted HTTP POST request to the /goform/WifiExtraSet endpoint. Include the wpapsk_crypto parameter with a payload that exceeds the expected buffer size, such as a string of repeated characters. The request should be made without authentication.