Tenda W20E Stack-Based Buffer Overflow Vulnerability in Web Management Interface

A stack-based buffer overflow vulnerability has been identified in the Tenda W20E enterprise router, specifically in version 15.11.0.6. The issue arises in the web management interface within the 'formPortalAuth' function of the '/goform/PortalAuth' endpoint. The vulnerability can be exploited remotely by sending an overly long string in the 'gotoUrl' parameter, leading to a buffer overflow that overwrites the return address and potentially allows for remote code execution with root privileges.

Impact

Exploitation of this vulnerability can cause a denial-of-service condition or lead to remote code execution with root privileges.

Reproduction

The vulnerability can be reproduced by sending a POST request to the '/goform/PortalAuth' endpoint with a crafted 'gotoUrl' parameter that exceeds 256 bytes. This can be done using a script that encodes the payload in base64 and includes it in the request.