Tenda W12 and i24 Stack-Based Buffer Overflow Vulnerability in cgiPingSet Function

A stack-based buffer overflow vulnerability has been identified in the Tenda W12 and i24 routers, specifically in the firmware versions 3.0.0.4(2887) and 3.0.0.5(3644). The vulnerability arises in the cgiPingSet function of the HTTP daemon, where the pingIP parameter is not properly validated, allowing for remote exploitation.

Impact

Exploitation of this vulnerability leads to a stack-based buffer overflow, which can commonly result in arbitrary code execution or causing the device to crash.

Reproduction

To reproduce this vulnerability, send a crafted request to the cgiPingSet function in the HTTP daemon. The request must include a pingIP parameter that exceeds the expected length, causing a buffer overflow on the stack.