Tenda FH451 Stack-Based Buffer Overflow Vulnerability in AdvSetWan Function

A stack-based buffer overflow vulnerability has been identified in the Tenda FH451 router, specifically in version 1.0.0.9. The issue arises in the function 'sub_3C434' within the file '/goform/AdvSetWan'. The vulnerability is triggered by manipulating the 'wanmode' and 'PPPOEPassword' parameters. When 'wanmode' is set to 2, the lack of length validation allows for a buffer overflow, which can be exploited remotely. This vulnerability has been publicly disclosed and is associated with the CVE identifier CVE-2026-3678.

Impact

Exploitation of this vulnerability leads to a stack-based buffer overflow, which can commonly result in arbitrary code execution or causing a denial-of-service condition.

Reproduction

To reproduce this vulnerability, send a POST request to '/goform/AdvSetWan' with the 'wanmode' parameter set to 2 and the 'PPPOEPassword' parameter filled with a long string. The absence of length checks will cause the stack-based buffer overflow.