Tenda AC15 Stack-Based Buffer Overflow Vulnerability in GetParentControlInfo Function

A stack-based buffer overflow vulnerability has been identified in the Tenda AC15 router, running firmware version 15.03.05.19. The issue arises in the GetParentControlInfo function within the file /goform/GetParentControlInfo. The vulnerability is caused by improper handling of the 'src' argument, which leads to a stack-based buffer overflow.

Impact

Exploitation of this vulnerability causes a stack-based buffer overflow, which can potentially be exploited to execute arbitrary code.

Reproduction

The vulnerability can be reproduced by sending a GET request to the /goform/GetParentControlInfo endpoint with a crafted 'mac' parameter. The payload should be a string of 51,200 bytes, followed by the bytes representing the hexadecimal value 'efbeadde'. This request can be made using a Python script that utilizes the 'requests' library.