Tenda G3 Stack Overflow Vulnerability in DHCP Rule Deletion Function Allowing Denial-of-Service

A stack overflow vulnerability has been identified in the Tenda G3 router, specifically in version through G3V3.0br_V15.11.0.17. The issue arises in the formDelDhcpRule function, where the delDhcpIndex parameter is processed without proper length validation. This flaw enables remote attackers to craft requests that overflow a stack-based buffer, potentially leading to a denial-of-service condition or arbitrary code execution.

Impact

Exploitation of this vulnerability causes a denial-of-service condition and could allow for remote code execution on the affected device.

Reproduction

The vulnerability can be reproduced by sending an HTTP POST request to the '/goform/delDhcpRule' endpoint with a crafted 'delDhcpIndex' parameter. The parameter should be sufficiently long to overflow the stack-based buffer, which can be automated with a simple script using a library like 'requests'.