Tenda AC20 Stack-Based Buffer Overflow Vulnerability in WAN MTU Parameter

A stack-based buffer overflow vulnerability has been identified in the Tenda AC20 wireless router, specifically in the firmware version 16.03.08.05. The issue arises in the file '/goform/fromAdvSetMacMtuWan', where the 'wanMTU' parameter is not properly validated, allowing for remote exploitation. This vulnerability could be exploited to execute arbitrary code on the device.

Impact

Exploitation of this vulnerability leads to a stack-based buffer overflow, which can be used to execute arbitrary code on the device.

Reproduction

The vulnerability can be reproduced by sending a POST request to the '/goform/fromAdvSetMacMtuWan' endpoint. The request must include a 'wanMTU' parameter with a payload that exceeds the buffer's capacity, taking advantage of the lack of input validation. This can be done using a cyclic pattern to overwrite the stack.