Tenda F3 Buffer Overflow Vulnerability in NAT Configuration

A buffer overflow vulnerability has been identified in the Tenda F3 router, specifically in versions 12.01.01.48_multi and later. The issue arises in the NAT configuration form, where the macFilterList parameter can be exploited.

Impact

Exploitation of this vulnerability leads to a buffer overflow, causing the device to crash and creating a denial-of-service condition.

Reproduction

The vulnerability can be reproduced by sending a POST request to the /goform/setNAT endpoint. The request must include a crafted macFilterList parameter that exceeds the buffer capacity, along with other required parameters for the NAT configuration.