Stack Buffer Overflow in Tenda-AX3 Router

CVE-2021-46394

Summary

A stack buffer overflow vulnerability exists in the formSetPPTPServer function of Tenda-AX3 routers. The vulnerability arises when the function processes the 'startIp' parameter from an HTTP request without proper input validation. By exploiting this flaw, an attacker can manipulate the stack memory, allowing for potential remote code execution if they carefully construct the input data. This vulnerability underscores the importance of secure coding practices in router firmware to prevent unauthorized access and control.

References