Tenda F456 Buffer Overflow Vulnerability in VirtualSer Function Allowing Remote Code Execution

A stack-based buffer overflow vulnerability has been identified in the Tenda F456 router, specifically in version 1.0.0.5. The issue arises in the 'fromVirtualSer' function within the 'httpd' component, where user-supplied data is improperly handled, leading to potential stack corruption. This vulnerability can be exploited remotely, with public proof-of-concept available.

Impact

Exploitation of this vulnerability causes a stack-based buffer overflow, which can lead to arbitrary code execution or a denial-of-service condition on the device.

Reproduction

The vulnerability can be reproduced by sending a POST request to '/goform/VirtualSer' with a 'page' parameter that contains a payload designed to overflow the stack buffer. The request must be made with the appropriate headers to simulate a legitimate XMLHttpRequest.