Tenda O3V2 Stack-Based Buffer Overflow Vulnerability

A critical stack-based buffer overflow vulnerability has been identified in the Tenda O3V2 router, specifically in the firmware version 1.0.0.12(3880). The issue arises in the httpd component, within the function fromPingResultGet, located in the file /goform/setPing. The vulnerability can be exploited remotely by manipulating the destIP argument, leading to potential arbitrary code execution.

Impact

Exploitation of this vulnerability causes a stack-based buffer overflow, allowing for arbitrary code execution on the affected device.

Reproduction

The vulnerability can be reproduced by sending a crafted ping request to the router's httpd service, specifically targeting the /goform/setPing endpoint. The destIP parameter must be manipulated to include a payload that exceeds the buffer size, causing a stack overflow. This can be done remotely, without any authentication.