Tenda FH1205 Stack-Based Buffer Overflow Vulnerability in VirtualSer Function

A critical stack-based buffer overflow vulnerability has been identified in the Tenda FH1205 router, specifically in the firmware version 2.0.0.7(775). The issue arises in the VirtualSer form processing, where the 'page' parameter can be manipulated, leading to memory corruption. This vulnerability can be exploited remotely, and details of the exploit are publicly available.

Impact

Exploitation of this vulnerability leads to a stack-based buffer overflow, which can commonly result in arbitrary code execution or causing the device to crash.

Reproduction

The vulnerability can be reproduced by sending a crafted request to the '/goform/VirtualSer' endpoint, manipulating the 'page' parameter to overflow the stack buffer. This can be done remotely without authentication.