Tenda F1202 PptpUserAdd fromPptpUserAdd stack-based overflow

Vulnerability

A stack-based buffer overflow vulnerability exists in the fromPptpUserAdd function of the Tenda F1202 router, specifically in firmware version 1.2.0.20(408). The function is located in the /goform/PptpUserAdd file and processes the opttype and username parameters. When opttype is set to 1, the username parameter is passed to sprintf without any length check, leading to overflow of a stack-based buffer s__3. This vulnerability is triggered via a POST request to the /goform/PPTPDClient endpoint [1].

Exploitation

An attacker can exploit this vulnerability remotely without authentication by sending a crafted HTTP POST request to the vulnerable endpoint. The request must include opttype=1 and a long username string (e.g., 1785 characters of 'a') to overflow the buffer. The exploit is publicly available and includes a proof-of-concept (PoC) that demonstrates the attack [1]. No user interaction or special network position is required beyond network access to the router's web interface.

Impact

Successful exploitation can result in denial of service (DoS) due to crash of the httpd process, or remote code execution (RCE) with the privileges of the web server. This could allow an attacker to fully compromise the router, potentially leading to further network attacks or data exfiltration [1].

Mitigation

As of the publication date, no official patch or firmware update has been released by Tenda to address this vulnerability. The vendor's website [2] does not list a fixed version. Users are advised to restrict remote access to the router's management interface, monitor for suspicious traffic, and consider replacing the device if it reaches end-of-life. The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.