Tenda CH22 Stack-Based Buffer Overflow Vulnerability in IPSECsave Function

A stack-based buffer overflow vulnerability has been identified in the Tenda CH22 router, specifically in version 1.0.0.1. The issue arises in the httpd component, within the 'fromIpsecitem' function of the '/goform/IPSECsave' file. The vulnerability can be exploited remotely by manipulating the 'ipsecno' parameter, leading to potential arbitrary code execution.

Impact

Exploitation of this vulnerability causes a stack-based buffer overflow, which can lead to arbitrary code execution on the device.

Reproduction

The vulnerability can be reproduced by sending a POST request to the '/goform/IPSECsave' endpoint with the 'opttype' parameter set to '2' and the 'ipsecno' parameter containing a crafted payload. This payload should be designed to overflow the buffer in the 'fromIpsecitem' function, which can be achieved by overwriting the return address on the stack with the address of a desired function, such as 'system', to execute arbitrary commands.