Tenda F456 L7Im frmL7ImForm buffer overflow

Vulnerability

A stack-based buffer overflow exists in the frmL7ImForm function within the /goform/L7Im endpoint of Tenda F456 firmware version 1.0.0.5 [1]. The function reads the user-controlled page argument and passes it to sprintf without length checking, writing into a fixed-size stack buffer s. This occurs in the httpd binary handling requests to the L7Im form [1].

Exploitation

An attacker can send a crafted POST request to /goform/L7Im with an overly long page parameter [1]. The proof-of-concept demonstrates sending 2319 bytes of payload in the page field via a standard HTTP POST [1]. No authentication or prior session is required; the request can be made remotely from any network position to the vulnerable router [1]. The attack requires no user interaction beyond the target device serving the web interface.

Impact

Successful exploitation overwrites the stack buffer, corrupting memory and allowing remote code execution (RCE) or denial-of-service (DoS) [1]. The attacker gains arbitrary code execution within the context of the httpd process, which typically runs with root privileges on embedded routers, leading to full device compromise [1].

Mitigation

No official fix has been released as of the publication date. The vendor's download page is available at [2], but no updated firmware version is listed. Users should monitor Tenda's support channels for a patched release. As a workaround, restrict access to the router's management interface to trusted internal networks only, or disable remote management if not needed [1].