Tenda G3 Stack Overflow Vulnerability in formSetDebugCfg Function Allowing Denial-of-Service

A stack overflow vulnerability has been identified in the Tenda G3 router, specifically in the firmware version G3V3.0br_V15.11.0.17. The issue arises in the formSetDebugCfg function, where user-provided parameters are passed to the sprintf function without proper length validation. This oversight allows remote attackers to craft HTTP POST requests that exploit the buffer overflow, leading to a denial-of-service condition or potentially allowing remote code execution.

Impact

Exploitation of this vulnerability causes a denial-of-service condition, with the potential for remote code execution.

Reproduction

The vulnerability can be reproduced by sending an HTTP POST request to the '/goform/setDebugCfg' endpoint with crafted parameters that overflow the stack-based buffer. This can be done using a Python script that includes the 'requests' library, where the 'enable' parameter is filled with a string of 'a' characters repeated 2000 times.