Tenda i12 Stack-Based Buffer Overflow Vulnerability in exeCommand Function

A stack-based buffer overflow vulnerability has been identified in the Tenda i12 router, specifically in version 1.0.0.6(2204). The issue arises in the exeCommand function, where the cmdinput parameter is passed to the vos_strcpy function without proper length validation. This lack of checks allows for the overflow of stack-based buffers, potentially leading to arbitrary code execution or a denial-of-service condition. The vulnerability can be exploited remotely, and a public exploit is available.

Impact

Exploitation of this vulnerability causes a stack-based buffer overflow, which can lead to arbitrary code execution or a denial-of-service condition.

Reproduction

The vulnerability can be reproduced by sending a POST request to the /goform/exeCommand endpoint. The request must include a cmdinput parameter with a payload that exceeds the buffer limit, effectively overwriting the stack.