Tenda F456 Buffer Overflow Vulnerability in P2P List Filter Function

A stack-based buffer overflow vulnerability has been identified in the Tenda F456 router, specifically in version 1.0.0.5. The issue arises in the 'fromP2pListFilter' function within the '/goform/P2pListFilter' file. The vulnerability is triggered by manipulating the 'menufacturer' and 'Go' arguments, allowing for remote exploitation. This buffer overflow can lead to a denial-of-service condition or potentially allow for remote code execution.

Impact

Exploitation of this vulnerability causes a stack-based buffer overflow, which can be leveraged for remote code execution or to create a denial-of-service condition.

Reproduction

The vulnerability can be reproduced by sending a POST request to '/goform/P2pListFilter' with a crafted 'page' parameter. The request must be made with 'X-Requested-With' set to 'XMLHttpRequest'. The payload should be designed to overflow the stack-based buffer by exceeding its capacity without proper length validation.