Tenda F456 Buffer Overflow Vulnerability in HTTPD Component

A stack-based buffer overflow vulnerability has been identified in the Tenda F456 router, specifically in version 1.0.0.5. The issue arises in the HTTP daemon (httpd) component, within the function 'fromwebExcptypemanFilter' of the file '/goform/webExcptypemanFilter'. The vulnerability is triggered by manipulating the 'page' argument, which is passed to the 'sprintf' function without proper length validation, allowing for stack memory overflow. This vulnerability can be exploited remotely, and public proof-of-concept exploits are available.

Impact

Exploitation of this vulnerability leads to a stack-based buffer overflow, which can commonly result in arbitrary code execution or causing a denial-of-service condition on the device.

Reproduction

The vulnerability can be reproduced by sending a POST request to '/goform/webExcptypemanFilter' with a 'page' parameter that contains a long string. The lack of length checking allows the input to overflow the stack-based buffer, potentially leading to code execution or a denial-of-service condition.