Tenda AC6 V2.0 Buffer Overflow Vulnerability in SetSpeedWan Function Allowing Denial-of-Service

A buffer overflow vulnerability has been identified in the Tenda AC6 V2.0 router, specifically in the firmware version 15.03.06.50. The issue arises in the SetSpeedWan function, where the speed_dir parameter is vulnerable to stack-based buffer overflow. This vulnerability can be exploited by sending crafted HTTP requests with excessive data in the speed_dir parameter, leading to a denial-of-service condition.

Impact

Exploitation of this vulnerability causes a denial-of-service condition on the affected router.

Reproduction

The vulnerability can be reproduced by sending an HTTP GET request to the '/goform/SetSpeedWan' endpoint with the 'speed_dir' parameter containing a payload of excessive length. This can be automated with a Python script that uses the 'requests' library to send the malformed request.