Tenda F1202 WrlExtraSet formWrlExtraSet stack-based overflow

Vulnerability

A stack-based buffer overflow vulnerability exists in the formWrlExtraSet function of Tenda F1202 firmware version 1.2.0.20(408). The flaw resides in the /goform/WrlExtraSet file and is triggered by manipulating the delno argument (internally passed as the GO parameter). The user-supplied GO value is passed to sprintf without length validation, leading to buffer overflow [1]. The affected product is Tenda F1202 version V1.2.0.20(408) [1].

Exploitation

An attacker can exploit this vulnerability remotely by sending a crafted HTTP POST request to /goform/WrlExtraSet with an overly long GO parameter. The reference provides a proof-of-concept (PoC) that sends a 557-character GO value, demonstrating the overflow [1]. No authentication is required; the attack can be initiated from the network [1].

Impact

Successful exploitation leads to stack-based buffer overflow, which can cause a denial of service (DoS) or potentially allow remote code execution (RCE) [1]. The attacker may achieve arbitrary code execution with the privileges of the httpd process, gaining full control of the device [1].

Mitigation

As of the publication date, Tenda has not released a patched firmware for the F1202. Users are advised to check the vendor website [2] for any future updates. Until a fix is available, network segmentation and restricting access to the device's web interface from untrusted networks can reduce exposure. The vulnerability is publicly known and could be exploited [1].