Tenda FH1201 Stack-Based Buffer Overflow Vulnerability in L7 Protocol Form

A critical stack-based buffer overflow vulnerability has been identified in the Tenda FH1201 router, specifically in version 1.2.0.14(408). The issue arises in the 'frmL7ProtForm' function within the '/goform/L7Prot' file, where the 'page' parameter can be manipulated, leading to the overflow. This vulnerability can be exploited remotely, and a public exploit is available.

Impact

Exploitation of this vulnerability leads to a stack-based buffer overflow, which can commonly result in arbitrary code execution or causing the device to crash.

Reproduction

The vulnerability can be reproduced by sending a crafted request to the '/goform/L7Prot' endpoint, manipulating the 'page' parameter to overflow the stack buffer. This can be done remotely, without authentication.