Tenda W20E Buffer Overflow Vulnerability in Wi-Fi User Management Function

A buffer overflow vulnerability has been identified in the Tenda W20E router, specifically in version V4.0br_V15.11.0.6. The issue arises in the 'goform/formAddWewifiWhiteUser' component, where the 'userInfo' value is processed by the 'addWewifiWhiteUser' function. The vulnerability can be exploited because 'sscanf' is used to handle 'userInfo' without proper size validation, allowing attackers to manipulate the input and cause a buffer overflow.

Impact

Exploitation of this vulnerability leads to a buffer overflow, which can commonly result in arbitrary code execution or causing the device to crash.