Tenda AC6 Buffer Overflow Vulnerability in SetSysTime Function

A buffer overflow vulnerability has been identified in the Tenda AC6 router, specifically in the firmware version V15.03.06.23_multi. The issue arises in the 'fromSetSysTime' function, where the 'ntpServer' parameter can be manipulated to cause a stack overflow. This vulnerability is exploited by sending a POST request to the 'SetSysTimeCfg' endpoint, with the 'ntpServer' parameter containing a crafted payload that exceeds the buffer capacity.

Impact

Exploitation of this vulnerability leads to a stack-based buffer overflow, which can commonly result in arbitrary code execution or causing the device to crash.

Reproduction

The vulnerability can be reproduced by sending a POST request to the 'http://192.168.1.1/goform/SetSysTimeCfg' URL. Include the 'ntpServer' parameter with a payload that is 1280 bytes long. This can be done using a script that automates the process, such as one written in Python using the 'requests' library.'