Tenda M3 Stack-Based Buffer Overflow Vulnerability in the formGetMasterPassengerAnalyseData Function

A stack-based buffer overflow vulnerability has been identified in the Tenda M3 router, specifically in version 1.0.0.12. The issue arises in the formGetMasterPassengerAnalyseData function within the file /goform/getMasterPassengerAnalyseData. The vulnerability is triggered by manipulating the 'time' parameter, which is passed to the 'strcpy' function without proper length validation, allowing for stack memory overflow. This vulnerability can be exploited remotely and has been publicly disclosed.

Impact

Exploitation of this vulnerability leads to a stack-based buffer overflow, which can commonly result in arbitrary code execution or causing the device to crash, denying service to legitimate users.

Reproduction

The vulnerability can be reproduced by sending a POST request to the /goform/getMasterPassengerAnalyseData endpoint. The request must include a 'time' parameter filled with a payload designed to overflow the buffer, such as a string of repeated characters. This can be done using a script that automates the process, such as one written in Python that uses the 'requests' library to send the crafted payload.