Tenda AC10 Buffer Overflow Vulnerability in AdvSetMacMtuWan

A buffer overflow vulnerability has been identified in the Tenda AC10 router, specifically in the firmware version V4.0si_V16.03.10.20. The vulnerability arises in the AdvSetMacMtuWan function, where the serviceName2 key value can be manipulated to cause a stack overflow. This issue allows remote, unauthenticated attackers to execute arbitrary commands with root privileges.

Impact

Exploitation of this vulnerability leads to a stack overflow, causing a segmentation fault and potentially allowing for arbitrary code execution as root.

Reproduction

The vulnerability can be reproduced by sending a POST request to the '/goform/AdvSetMacMtuWan' endpoint with the 'serviceName2' parameter set to a string of repeated characters, approximately 768 bytes in length. This can be done using a Python script that imports the requests library.