Tenda WH450 Stack-Based Buffer Overflow Vulnerability in HTTP Request Handler

A stack-based buffer overflow vulnerability has been identified in the Tenda WH450 router, specifically in the firmware version 1.0.0.18. The issue arises within the HTTP request handler for the '/goform/SetIpBind' endpoint, where excessive data lengths in the 'page' parameter can be manipulated to cause the overflow. This vulnerability can be exploited remotely by unauthenticated attackers, potentially leading to arbitrary code execution or causing denial-of-service conditions.

Impact

Exploitation of this vulnerability allows for a stack-based buffer overflow, which can be leveraged to execute arbitrary code or cause a denial-of-service condition on the device.

Reproduction

The vulnerability can be reproduced by sending a GET request to the '/goform/SetIpBind' endpoint with an excessively long 'page' parameter. The request must also include 'op', 'check', and 'default_mode' parameters to be processed correctly. After the overflow occurs, the device may become unresponsive or exhibit unexpected behavior, indicating a successful exploitation.