Tenda AC8V4 Stack Overflow Vulnerability in Parent Control Function

A stack overflow vulnerability has been identified in the Tenda AC8V4 router, specifically in version V16.03.34.06. The issue arises in the 'get_parentControl_list_Info' function, where the 'urls' parameter is improperly handled, leading to potential memory corruption.

Impact

Exploitation of this vulnerability causes a stack overflow, which can lead to arbitrary code execution or a denial-of-service condition, depending on the attacker's intent and the context in which the vulnerability is exploited.

Reproduction

To reproduce this vulnerability, send a request to the 'get_parentControl_list_Info' function with a crafted 'urls' parameter that exceeds the buffer size. This can be done using a tool like Burp Suite or by writing a custom script that sends the appropriate request. Monitor the device for signs of a stack overflow, such as a crash or unexpected behavior.