Tenda F453 Buffer Overflow Vulnerability in DHCP Client List Handling

A buffer overflow vulnerability has been identified in the Tenda F453 router, specifically in version 1.0.0.3. The issue arises in the HTTP component, within the 'fromDhcpListClient' function of the '/goform/DhcpListClient' file. The vulnerability allows remote exploitation by manipulating the 'page' argument, leading to potential denial-of-service conditions or arbitrary code execution.

Impact

Exploitation of this vulnerability causes a buffer overflow, which can lead to stack corruption. This type of memory corruption vulnerability commonly allows for arbitrary code execution or causing the device to crash, creating a denial-of-service condition.

Reproduction

The vulnerability can be reproduced by sending a POST request to '/goform/DhcpListClient' with a 'page' parameter that contains a long string. The lack of proper length validation on the 'page' parameter allows the overflow to occur.