Tenda AC23 Buffer Overflow Vulnerability in formSetPPTPUserList Function

A buffer overflow vulnerability has been identified in the Tenda AC23 router, specifically in the version 16.03.07.52. The issue arises in the formSetPPTPUserList function within the HTTP POST request handler. The vulnerability can be exploited remotely by manipulating the 'list' parameter in a POST request, leading to unauthorized memory access and potential code execution.

Impact

Exploitation of this vulnerability causes a buffer overflow, which can lead to arbitrary code execution by overwriting the memory stack.

Reproduction

To reproduce this vulnerability, send a POST request to the router's HTTP server with a crafted 'list' parameter that exceeds the buffer size expected by the formSetPPTPUserList function. This can be done using a variety of tools that allow for HTTP request manipulation, such as Burp Suite or Postman.