Tenda W18E Stack-Based Buffer Overflow Vulnerability in the formSetAccountList Function

A stack-based buffer overflow vulnerability has been identified in the Tenda W18E router, specifically in version 16.01.0.11. The issue arises in the formSetAccountList function within the /goform/setModules file. This vulnerability can be exploited remotely by manipulating the Password argument, leading to a denial-of-service condition where the httpd process crashes.

Impact

Exploitation of this vulnerability causes a denial-of-service condition by crashing the httpd process, which can disrupt normal router operations.

Reproduction

The vulnerability can be reproduced by sending a specially crafted packet that manipulates the Password argument in the formSetAccountList function, which is processed by the httpd service.