Tenda AC6 Stack-Based Buffer Overflow Vulnerability in POST Request WizardHandle

A stack-based buffer overflow vulnerability has been identified in the Tenda AC6 router, specifically in the version 15.03.05.16. The issue arises in the 'fromWizardHandle' function within the '/goform/WizardHandle' file, part of the POST request handler. The vulnerability can be exploited remotely by manipulating the 'WANT' or 'WANS' parameters, leading to potential arbitrary code execution.

Impact

Exploitation of this vulnerability causes a stack-based buffer overflow, which can lead to arbitrary code execution.

Reproduction

To reproduce this vulnerability, send a POST request to the '/goform/WizardHandle' endpoint. Include the 'WANT' or 'WANS' parameter with a payload that exceeds the buffer capacity, targeting the 'fromWizardHandle' function. This will trigger the stack-based buffer overflow vulnerability.