Tenda AC20 Buffer Overflow Vulnerability in SetSysTimeCfg Function

A critical buffer overflow vulnerability has been identified in the Tenda AC20 router, affecting versions through 16.03.08.12. The issue arises in the httpd component, specifically within the SetSysTimeCfg function. The vulnerability is triggered by manipulating the timeZone argument, which leads to a buffer overflow. This flaw can be exploited remotely, potentially causing a denial-of-service condition or allowing arbitrary code execution.

Impact

Exploitation of this vulnerability causes a buffer overflow, which can lead to arbitrary code execution with elevated privileges.

Reproduction

The vulnerability can be reproduced by sending a crafted HTTP POST request to the /goform/SetSysTimeCfg endpoint. The request must include a timeZone value that exceeds the buffer's capacity, causing the overflow. Once the vulnerability is triggered, it can be exploited to execute arbitrary commands and escalate privileges.