CVE-2022-46540

Vulnerability

A buffer overflow vulnerability exists in Tenda F1203 firmware version V2.0.1.6 in the httpd module when handling the /goform/addressNat request. The flaw is triggered by an overly long entrys parameter in the POST body, leading to a buffer overflow in the fromAddressNat function [1].

Exploitation

An attacker with network access to the router can send a crafted HTTP POST request to /goform/addressNat with a large entrys parameter value. No authentication is required (the proof-of-concept uses a default admin cookie). The request causes a buffer overflow, resulting in a denial of service [1].

Impact

Successful exploitation causes the httpd service to crash, rendering the router unresponsive until reboot. There is no indication of code execution or information disclosure; only denial of service is demonstrated [1].

Mitigation

As of the publication date (2022-12-20), no official patch or firmware update has been released to address this vulnerability. Users may consider upgrading to a newer router model or contacting Tenda for support. Workarounds are not available [1].