Tenda WH450 Stack-Based Buffer Overflow Vulnerability in NatStaticSetting Endpoint

A stack-based buffer overflow vulnerability has been identified in the Tenda WH450 router running firmware version 1.0.0.18. The issue arises in the HTTP request handler for the '/goform/NatStaticSetting' endpoint, where excessive data lengths in the 'page' parameter can be manipulated to cause the overflow. This vulnerability can be exploited remotely by unauthenticated attackers, potentially leading to arbitrary code execution or causing denial-of-service conditions.

Impact

Exploitation of this vulnerability allows for a stack-based buffer overflow, which can commonly lead to arbitrary code execution or causing the device to become unresponsive.

Reproduction

The vulnerability can be reproduced by sending a GET request to the '/goform/NatStaticSetting' endpoint with the 'page' parameter overloaded with approximately 240 bytes of data. The 'entrys' and 'op' parameters are also required but do not contribute to the vulnerability.