Tenda AC18 Stack Overflow Vulnerability in AdvSetMacMtuWan Function

A stack overflow vulnerability has been identified in the Tenda AC18 router, specifically in version V15.03.05.19. The issue arises in the 'AdvSetMacMtuWan' function, where the 'mac' parameter can be manipulated. This parameter is passed to 'strcpy', creating a buffer overflow condition.

Impact

Exploitation of this vulnerability leads to a stack overflow, causing a segmentation fault on the router.

Reproduction

The vulnerability can be reproduced by sending a POST request to the '/goform/AdvSetMacMtuWan' endpoint. The request must include a crafted 'mac' parameter that exceeds the buffer size, such as a string of repeated characters. Additional parameters like 'wanMTU', 'wanSpeed', 'cloneType', 'wanMTU2', 'wanSpeed2', 'cloneType2', and 'mac2' can also be included, but are not necessary for the exploitation.