Tenda F453 Buffer Overflow Vulnerability in httpd Component

A buffer overflow vulnerability has been identified in the Tenda F453 router, specifically in version 1.0.0.3. The issue arises in the httpd component, within the function 'fromSetWifiGusetBasic' of the file '/goform/AdvSetWrlsafeset'. The vulnerability is triggered by manipulating the 'mit_ssid' parameter, which is passed to the 'sprintf' function without proper length validation, allowing for stack-based buffer overflow. This vulnerability can be exploited remotely, potentially leading to a denial-of-service condition or arbitrary code execution.

Impact

Exploitation of this vulnerability causes a buffer overflow, which can disrupt normal operation or allow for the execution of arbitrary code.

Reproduction

The vulnerability can be reproduced by sending a POST request to '/goform/AdvSetWrlsafeset' with an excessively long 'mit_ssid' parameter. The request must include the 'X-Requested-With' header set to 'XMLHttpRequest'.