Tenda AC6 Buffer Overflow Vulnerability in the getRebootStatus Callback

A buffer overflow vulnerability has been identified in the Tenda AC6 router, specifically in the firmware version 15.03.05.16_multi. The issue arises in the sub_452A4 function, where the 'getRebootStatus' callback parameter can be manipulated via HTTP requests, leading to potential memory corruption.

Impact

Exploitation of this vulnerability causes a buffer overflow, which can commonly lead to arbitrary code execution or causing a device to crash.

Reproduction

To reproduce this vulnerability, send an HTTP request to the Tenda AC6 router's 'getRebootStatus' endpoint. Include a crafted 'callback' parameter that exceeds the expected length, triggering the buffer overflow in the sub_452A4 function.