Tenda AC6 Buffer Overflow Vulnerability in IP-MAC Binding Function

A buffer overflow vulnerability has been identified in the Tenda AC6 router, specifically in the firmware version V15.03.06.23_multi. The issue arises in the 'fromSetIpMacBind' function, where user-supplied data in the 'list' parameter is not properly validated. This lack of validation allows for a buffer overflow to occur when 'bindnum' is set between 1 and 32, as the 'list' parameter is copied into a stack buffer without checks, leading to potential memory corruption.

Impact

Exploitation of this vulnerability causes a buffer overflow, which can commonly lead to arbitrary code execution or memory corruption.

Reproduction

The vulnerability can be reproduced by sending a POST request to 'http://192.168.1.1/goform/SetIpMacBind' with a crafted 'list' parameter. The 'bindnum' parameter should be set to a value between 1 and 32. The request must include a cookie named 'password' with the value 'yectgb'.