Tenda F456 Buffer Overflow Vulnerability in HTTPD Component

A stack-based buffer overflow vulnerability has been identified in the Tenda F456 router, specifically in version 1.0.0.5. The issue arises in the HTTP daemon (httpd) component, within the 'frmL7ProtForm' function of the '/goform/L7Prot' file. The vulnerability is triggered by manipulating the 'page' argument, which is processed by the 'sprintf' function without proper length validation, leading to a stack overflow. This flaw allows for remote exploitation, with potential consequences including a denial-of-service condition or arbitrary code execution.

Impact

Exploitation of this vulnerability causes a stack-based buffer overflow, which can lead to arbitrary code execution or a denial-of-service condition on the device.

Reproduction

The vulnerability can be reproduced by sending a POST request to '/goform/L7Prot' with a 'page' parameter that contains a long string. The lack of length checking allows the input to overflow the stack-based buffer, creating the potential for code execution or causing the device to crash.