Tenda AC9 Router Stack Overflow Vulnerability in WifiWpsStart Form Leading to Remote Code Execution

A stack overflow vulnerability has been identified in the Tenda AC9 router, version 1.0, running firmware V15.03.05.14_multi. The issue resides in the WifiWpsStart form, where the index parameter from POST requests is improperly handled. The vulnerability allows for remote arbitrary code execution.

Impact

Exploitation of this vulnerability could lead to unauthorized remote code execution on the affected router.

Reproduction

To reproduce this vulnerability, send a POST request to the /goform/WifiWpsStart endpoint. Include an excessively long index parameter in the request. The lack of length validation in the firmware allows the long index to overflow the stack, potentially leading to arbitrary code execution.