Tenda G3 Stack Overflow Vulnerability in Dns Forward Rule Store Function Allowing Denial-of-Service

A stack overflow vulnerability has been identified in the Tenda G3 router, specifically in the firmware version G3V3.0br_V15.11.0.17. The issue arises in the 'dns_forward_rule_store' function, where user-provided data is improperly handled. The vulnerability allows remote attackers to cause a denial-of-service condition by sending a crafted HTTP POST request that exploits the buffer overflow. In some cases, this vulnerability could also be leveraged for remote code execution.

Impact

Exploitation of this vulnerability leads to a denial-of-service condition, with the potential for remote code execution.

Reproduction

The vulnerability can be reproduced by sending an HTTP POST request to the '/goform/AddDnsForward' endpoint. The request must include a 'dhcpIndex' parameter with a value that exceeds 2000 characters. This payload will trigger the stack-based buffer overflow in the 'dns_forward_rule_store' function.