Tenda O3V2 Buffer Overflow Vulnerability in MAC Filter Function

A buffer overflow vulnerability has been identified in the Tenda O3V2 router, specifically in version 1.0.0.12(3880). The issue arises in the 'fromSafeSetMacFilter' function, where the 'mac' parameter is not properly validated. This lack of input sanitization allows remote attackers to send excessively long data, leading to a stack overflow. Exploitation of this vulnerability can cause the router to crash, disrupt normal service, and potentially allow for arbitrary code execution.

Impact

Exploitation of this vulnerability causes the router to crash, leading to a denial of service where the device cannot provide services correctly and persistently. Additionally, the nature of the buffer overflow could allow for arbitrary code execution.

Reproduction

To reproduce this vulnerability, send a POST request to the '/goform/setMacFilterList' endpoint. Include a 'mac' parameter with a payload that is excessively long. The router will crash, demonstrating the buffer overflow vulnerability.