Tenda AC18 Stack-Based Buffer Overflow Vulnerability in DLNA Configuration Handler

A stack-based buffer overflow vulnerability has been identified in the Tenda AC18 router, specifically in version 15.03.05.05. The issue arises in the HTTP request handler, particularly within the '/goform/SetDlnaCfg' endpoint. When the 'scanList' parameter is supplied with excessive data, the vulnerability is triggered during the processing of the request, potentially allowing remote attackers to execute arbitrary code or cause a denial-of-service condition.

Impact

Exploitation of this vulnerability leads to a stack-based buffer overflow, which can commonly result in arbitrary code execution or causing a denial-of-service condition on the device.

Reproduction

The vulnerability can be reproduced by sending an HTTP GET request to the '/goform/SetDlnaCfg' endpoint with a 'scanList' parameter that contains excessive data. This can be done using a script that automates the process, such as one written in Python that uses the 'requests' library to send the payload.