Tenda G3 Stack Overflow Vulnerability in formIPMacBindModify Function Allowing Denial-of-Service

A stack overflow vulnerability has been identified in the Tenda G3 router, specifically in the firmware version G3V3.0br_V15.11.0.17. The issue arises in the formIPMacBindModify function, where multiple user-provided parameters are accepted without proper length validation. This flaw enables remote attackers to craft requests that overflow the stack buffer, leading to a denial-of-service condition or potentially allowing remote code execution.

Impact

Exploitation of this vulnerability causes a denial-of-service condition, with the possibility of remote code execution.

Reproduction

The vulnerability can be reproduced by sending an HTTP POST request to the '/goform/modifyIpMacBind' endpoint. The request must include a crafted payload that exploits the lack of length checks on the 'IPMacBindRuleRemark' parameter, such as by using a string of repeated characters to overflow the buffer.