Tenda F3 Buffer Overflow Vulnerability in Parent Control Management

A buffer overflow vulnerability has been identified in the Tenda F3 router, specifically in versions V12.01.01.48_multi and later. The issue arises in the 'goform/setParentControl' endpoint, where the 'onlineList' parameter can be manipulated to cause a buffer overflow.

Impact

Exploitation of this vulnerability leads to a buffer overflow, causing the device to crash and creating a denial-of-service condition.

Reproduction

The vulnerability can be reproduced by sending a POST request to the '/goform/setParentControl' endpoint. The request must include the 'onlineList' parameter, which should be crafted to overflow the buffer. This can be done by appending a large amount of data after a valid input, such as a MAC address or IP address, effectively overwriting adjacent memory and causing the device to crash.