Tenda F453 Buffer Overflow Vulnerability in HTTPD Component

A buffer overflow vulnerability has been identified in the Tenda F453 router, specifically in version 1.0.0.3. The issue arises in the HTTP daemon (httpd) within the 'fromAddressNat' function of the '/goform/addressNat' file. The vulnerability is triggered by manipulating the 'entrys' parameter, which is passed to the 'sprintf' function without proper length validation, allowing for stack-based buffer overflow. This vulnerability can be exploited remotely, and a public exploit is available.

Impact

Exploitation of this vulnerability leads to a buffer overflow, which can commonly result in arbitrary code execution or causing a denial-of-service condition.

Reproduction

The vulnerability can be reproduced by sending a POST request to the '/goform/addressNat' endpoint. The request must include a 'Content-Length' header that specifies a length of 2489 bytes. The 'entrys' parameter should be populated with a payload that exceeds the buffer size, effectively causing the overflow.