Tenda F1202 GstDhcpSetSerof formGstDhcpSetSer stack-based overflow

Vulnerability

The vulnerability resides in Tenda F1202 firmware version 1.2.0.20(408) within the httpd binary. The function formGstDhcpSetSer in the file /goform/GstDhcpSetSerof handles the dips argument without proper length validation. When the dips parameter is passed to a sprintf-style function into a stack buffer, the lack of bounds checking leads to a stack-based buffer overflow [1].

Exploitation

The attacker must be able to send HTTP POST requests to the router’s web interface. No authentication is required, as the vulnerable endpoint is exposed. By crafting a POST request to /goform/GstDhcpSetSerof with an overly long dips argument, the stack buffer overflows. A publicly disclosed proof of concept demonstrates a similar overflow in the related formSafeEmailFilter function [1].

Impact

Successful exploitation allows an unauthenticated remote attacker to overwrite adjacent stack memory. This can lead to denial of service (device crash) or arbitrary code execution at the privilege level of the httpd process, giving the attacker full control over the router [1].

Mitigation

No fixed version has been released by Tenda as of the publication date. Users should monitor the vendor’s support page [2] for a firmware update. Until a patch is available, restrict external access to the router’s management interface and disable remote administration if possible.