Tenda AC8V4 Stack-Based Buffer Overflow Vulnerability in WifiGuestSet

A stack-based buffer overflow vulnerability has been identified in the Tenda AC8V4 router, specifically in version V16.03.34.06. The issue arises in the WifiGuestSet form handler, where the shareSpeed parameter can be manipulated. This parameter lacks a length restriction, allowing excessively long strings to be copied to the stack using the strcpy function, ultimately causing a stack overflow.

Impact

Exploitation of this vulnerability leads to a stack overflow, which can commonly result in arbitrary code execution or causing the device to crash.

Reproduction

The vulnerability can be reproduced by sending a POST request to the /goform/WifiGuestSet endpoint with the shareSpeed parameter. The value of this parameter should be a string long enough to exceed the buffer limit, such as 2000 bytes of repeated 'A' characters.