Tenda AC20 Stack-Based Buffer Overflow Vulnerability in SetStaticRouteCfg

A stack-based buffer overflow vulnerability has been identified in the Tenda AC20 wireless router, specifically in the firmware version 16.03.08.05. The issue arises in the file '/goform/SetStaticRouteCfg', where the 'list' parameter is not properly validated, allowing attackers to manipulate the input and overflow the stack. This vulnerability can be exploited remotely, potentially leading to arbitrary code execution on the device.

Impact

Exploitation of this vulnerability allows for remote code execution on the affected device. Additionally, the vulnerability can cause the device to crash, disrupting its normal operation.

Reproduction

The vulnerability can be reproduced by sending a request to the '/goform/SetStaticRouteCfg' endpoint with a crafted 'list' parameter that exceeds the buffer limit. This can be done using a proof-of-concept exploit that leverages the buffer overflow to execute arbitrary code.