Tenda G3 Stack Overflow Vulnerability in formSetStaticRoute Function Allowing Denial-of-Service

A stack overflow vulnerability has been identified in the Tenda G3 router, specifically in the firmware version G3V3.0br_V15.11.0.17. The issue arises in the formSetStaticRoute function, where the staticRouteGateway parameter is processed without proper length validation. This flaw enables remote attackers to craft requests that overflow a stack-based buffer, leading to a denial-of-service condition or potentially allowing remote code execution.

Impact

Exploitation of this vulnerability causes a denial-of-service condition, with the possibility of remote code execution.

Reproduction

To reproduce this vulnerability, send an HTTP POST request to the '/goform/setStaticRoute' endpoint. Include a 'staticRouteGateway' parameter with a value that exceeds the buffer limit, such as a string of repeated characters totaling 1000 in length. The router will respond with a denial-of-service condition.