Tenda AC5 Stack-Based Buffer Overflow Vulnerability in POST Request Handler

A stack-based buffer overflow vulnerability has been identified in the Tenda AC5 router, specifically in the firmware version 15.03.06.47. The issue arises in the POST request handler, within the 'decodePwd' function of the '/goform/WizardHandle' file. The vulnerability can be exploited remotely by manipulating the 'WANT' or 'WANS' parameters, leading to potential unauthorized memory access and execution of arbitrary code.

Impact

Exploitation of this vulnerability allows for a stack-based buffer overflow, which can commonly lead to arbitrary code execution or causing the device to crash.

Reproduction

To reproduce this vulnerability, send a POST request to the '/goform/WizardHandle' endpoint with a crafted 'WANT' or 'WANS' parameter that exceeds the buffer capacity expected by the 'decodePwd' function. This will trigger the stack-based buffer overflow by overwriting adjacent memory on the stack.