Tenda F3 Buffer Overflow Vulnerability in WiFi Time Management

A buffer overflow vulnerability has been identified in the Tenda F3 router, specifically in versions V12.01.01.48_multi and later. The issue arises in the WiFi time management feature, where the 'wifiTimeClose' parameter in the 'goform/setWifi' endpoint can be exploited.

Impact

Exploitation of this vulnerability leads to a buffer overflow, causing the device to crash and creating a denial-of-service condition.

Reproduction

The vulnerability can be reproduced by sending a POST request to the 'goform/setWifi' endpoint. The request must include the 'wifiTimeClose' parameter, which should be crafted to overflow the buffer. This can be done by appending a large amount of data after a valid time range, such as '00:00-07:00'.