Tenda AC20 Buffer Overflow Vulnerability in PowerSaveSet Form

A buffer overflow vulnerability has been identified in the Tenda AC20 router, affecting firmware versions through 16.03.08.12. The issue arises in the PowerSaveSet form, where the sscanf function improperly validates input from the powerSavingEn, time, powerSaveDelay, and ledCloseType fields. This vulnerability can be exploited remotely, potentially leading to a denial-of-service condition or arbitrary code execution.

Impact

Exploitation of this vulnerability causes a buffer overflow, which can lead to arbitrary code execution or a denial-of-service condition.

Reproduction

The vulnerability can be reproduced by sending a crafted HTTP POST request to the /goform/PowerSaveSet endpoint. The request must include the powerSavingEn, time, powerSaveDelay, and ledCloseType parameters. The absence of proper input validation allows for the buffer overflow to occur.