CVE-2022-46534

Vulnerability

A buffer overflow vulnerability exists in the httpd module of Tenda F1203 router firmware version V2.0.1.6. The flaw is triggered when processing a POST request to the /goform/SetSpeedWan endpoint, specifically through the speed_dir parameter. The affected firmware is available from the manufacturer's download page [1].

Exploitation

An attacker with network access to the router's web interface can exploit this vulnerability by sending a crafted POST request to /goform/SetSpeedWan with an excessively long speed_dir value. The provided proof-of-concept demonstrates a string of over 4000 'a' characters, which causes a buffer overflow and results in a denial of service [1].

Impact

Successful exploitation leads to a denial of service (DoS) condition, causing the router to crash or become unresponsive. No remote code execution or data disclosure has been reported for this vulnerability [1].

Mitigation

As of the publication date, no official patch or firmware update has been released by Tenda to address this vulnerability. Users are advised to restrict network access to the router's management interface and monitor for future firmware updates [1].