Tenda AC15 Buffer Overflow Vulnerability in MAC Filter Configuration

A buffer overflow vulnerability exists in the Tenda AC15 router, specifically in version V15.03.05.18_multi. The issue arises within the 'goform/formSetMacFilterCfg' function, where user-supplied parameters are passed to a function without proper input validation. This lack of validation allows for an overflow to occur, potentially leading to arbitrary code execution or other malicious outcomes.

Impact

Exploitation of this vulnerability causes a buffer overflow, which can lead to arbitrary code execution.

Reproduction

The vulnerability can be reproduced by sending a POST request to 'http://192.168.1.1/goform/setMacFilterCfg' with the 'macFilterType' parameter set to 'black' and the 'deviceList' parameter containing a crafted MAC address. The request must include a cookie with the password 'ssetgb'.