Tenda AC15 Stack-Based Buffer Overflow Vulnerability in POST Request Handler

A stack-based buffer overflow vulnerability has been identified in the Tenda AC15 router, specifically in the firmware version 15.03.05.19. The issue arises in the POST request handler function 'formSetCfm', located in the file '/goform/setcfm'. The vulnerability is triggered by manipulating the 'funcpara1' parameter, which allows for remote exploitation. The overflow occurs because the 'funcpara1' input can exceed the fixed buffer size of 64 bytes, leading to potential arbitrary code execution.

Impact

Exploitation of this vulnerability causes a stack-based buffer overflow, which can lead to arbitrary code execution.

Reproduction

To reproduce this vulnerability, send a POST request to '/goform/setcfm' with a 'funcpara1' parameter that exceeds 64 bytes. The 'formSetCfm' function will process the input, causing a buffer overflow by overwriting the stack.