Tenda AC5 Stack-Based Buffer Overflow Vulnerability in POST Request Handler

A stack-based buffer overflow vulnerability has been identified in the Tenda AC5 router, specifically in version 15.03.06.47. The issue arises in the 'formWifiWpsOOB' function within the '/goform/WifiWpsOOB' file, part of the POST Request Handler component. The vulnerability can be exploited remotely by manipulating the 'index' parameter in a POST request, leading to the potential overwriting of the function's return address.

Impact

Exploitation of this vulnerability allows for a stack-based buffer overflow, where the attacker can overwrite the return address of the function, potentially leading to arbitrary code execution.

Reproduction

To reproduce this vulnerability, send a POST request to the '/goform/WifiWpsOOB' endpoint with a crafted 'index' parameter. The value of the 'index' parameter should be manipulated to overflow the stack buffer, overwriting the return address of the 'formWifiWpsOOB' function.