Tenda G3 Stack Overflow Vulnerability in DHCP Rule Modification Function Allowing Denial-of-Service

A stack overflow vulnerability has been identified in the Tenda G3 router, specifically in version 3.0br_V15.11.0.17. The issue arises in the 'modifyDhcpRule' function, where the 'bindDhcpIndex' parameter is processed without proper length validation. This flaw enables remote attackers to craft requests that overflow the stack buffer, leading to a denial-of-service condition or potentially allowing remote code execution.

Impact

Exploitation of this vulnerability causes a denial-of-service condition, with the possibility of remote code execution.

Reproduction

The vulnerability can be reproduced by sending an HTTP POST request to the '/goform/modifyDhcpRule' endpoint. The request must include a 'bindDhcpIndex' parameter with a value that exceeds the buffer's capacity, such as a string of repeated characters. This can be done using a script that automates the request process, such as one written in Python using the 'requests' library.