Tenda FH451 Stack-Based Buffer Overflow Vulnerability in fromDhcpListClient Function Allowing Denial-of-Service

A stack-based buffer overflow vulnerability has been identified in the Tenda FH451 router, specifically in version 1.0.0.9. The issue arises in the 'fromDhcpListClient' function, which is part of the device's CGI handler. This vulnerability allows attackers to cause a denial-of-service condition by sending a crafted HTTP request that exploits the 'list1' parameter. The overflow occurs because the parameter is not properly validated before being copied into a buffer, leading to a process crash or instability on the device.

Impact

Exploitation of this vulnerability causes a process crash or instability on the device, leading to a denial-of-service condition.

Reproduction

To reproduce this vulnerability, send a crafted HTTP request to the 'fromDhcpListClient' CGI endpoint. Include a long 'list1' parameter, such as 'a' repeated multiple times, and set 'LISTLEN' to 1. This will trigger the stack-based buffer overflow by overwriting the return address on the stack.