Tenda AC21 Buffer Overflow Vulnerability in SetNetControlList Function

A buffer overflow vulnerability has been identified in the Tenda AC21 router running version 16.03.08.16. The issue arises in the SetNetControlList file, specifically within the formSetQosBand function. The vulnerability can be exploited remotely by manipulating the argument list, leading to a buffer overflow condition. This flaw is critical as it could potentially allow for remote code execution.

Impact

Exploitation of this vulnerability causes a buffer overflow, which can lead to arbitrary code execution or cause the device to crash.

Reproduction

The vulnerability can be reproduced by sending a crafted request to the /goform/SetNetControlList endpoint, manipulating the 'list' argument to trigger the buffer overflow.