Tenda AC6 Buffer Overflow Vulnerability in AdvSetMacMtuWan Function Allowing Denial-of-Service

A stack-based buffer overflow vulnerability has been identified in the Tenda AC6 V2.0 router, specifically in the firmware version 15.03.06.50. The issue arises within the AdvSetMacMtuWan function, where multiple parameters can be exploited by injecting crafted payloads. This vulnerability allows remote attackers to cause a denial-of-service condition by sending malformed HTTP requests that overflow the buffer and disrupt normal device operation.

Impact

Exploitation of this vulnerability leads to a denial-of-service condition, causing the device to become unresponsive or unavailable.

Reproduction

The vulnerability can be reproduced by sending a GET request to the '/goform/AdvSetMacMtuWan' endpoint with excessive data in the 'serverName' parameter. This can be automated with a Python script that uses the 'requests' library to send the payload. The payload should consist of 0x110 bytes of 'A' followed by the string 'DOIT'.