Tenda CH22 Buffer Overflow Vulnerability in deleteUserName Function

A critical buffer overflow vulnerability has been identified in the Tenda CH22 router, specifically in the 1.0.0.1 firmware version. The issue arises in the 'formdeleteUserName' function within the '/goform/deleteUserName' endpoint. The vulnerability is triggered by manipulating the 'old_account' parameter, allowing for remote exploitation. This buffer overflow can be exploited to crash the router, making it inaccessible.

Impact

Exploitation of this vulnerability leads to a stack overflow, causing the router to crash and become unresponsive.

Reproduction

The vulnerability can be reproduced by sending a POST request to the '/goform/deleteUserName' endpoint with the 'old_account' parameter. The parameter should be filled with a payload that exceeds the buffer limit, such as 1000 bytes of arbitrary data. This can be done using a Python script that automates the process.