Tenda CH22 Denial-of-Service Vulnerability in DHCP Client List Handling

A denial-of-service vulnerability has been identified in the Tenda CH22 router, specifically in versions up to 1.0.0.1. The issue arises in the 'fromDhcpListClient' function within the '/goform/DhcpListClient' file. The vulnerability is triggered by manipulating the 'LISTLEN' parameter, which leads to excessive CPU usage and resource exhaustion. This causes the web server to become unresponsive, typically prompting the device to reboot, thereby disrupting service.

Impact

Exploitation of this vulnerability leads to a complete denial-of-service condition, causing the device to become unresponsive and often requiring a manual reboot.

Reproduction

The vulnerability can be reproduced by sending an HTTP POST request to the '/goform/DhcpListClient' endpoint with the 'LISTLEN' parameter set to a very high value, such as '1000000'. This overloads the device's processing capacity, causing it to hang or crash.