Tenda CH22 Stack-Based Buffer Overflow Vulnerability in Parameter Handler

A stack-based buffer overflow vulnerability has been identified in the Tenda CH22 router, specifically in version 1.0.0.1. The issue arises in the 'fromAdvSetWan' function within the '/goform/AdvSetWan' file, part of the Parameter Handler component. The vulnerability is triggered by manipulating the 'wanmode' and 'PPPOEPassword' parameters. When 'wanmode' is set to 2, the function processes the input without proper length validation, leading to a buffer overflow on the stack. This vulnerability can be exploited remotely, and a public exploit is available.

Impact

Exploitation of this vulnerability causes a stack-based buffer overflow, which can lead to arbitrary code execution or a denial-of-service condition.

Reproduction

The vulnerability can be reproduced by sending a POST request to the '/goform/AdvSetWan' endpoint. The request must include 'wanmode' set to 2 and a crafted 'PPPOEPassword' value that exceeds the buffer length, causing a stack-based overflow.