Attack Chain

1. The attacker identifies a vulnerable Tenda F451 router running firmware version 1.0.0.7.
2. The attacker crafts a malicious HTTP request targeting the /goform/addressNat endpoint.
3. The HTTP request includes a specifically crafted entrys argument designed to overflow the stack buffer in the fromAddressNat function.
4. The httpd service on the Tenda router receives the malicious request and processes the entrys argument.
5. The fromAddressNat function copies the attacker-controlled data from the entrys argument into a fixed-size stack buffer without proper bounds checking.
6. The oversized data overflows the stack buffer, overwriting adjacent memory locations, including the return address.
7. The function returns, but instead of returning to the caller, it jumps to an address controlled by the attacker, effectively executing arbitrary code.
8. The attacker gains remote code execution on the Tenda F451 router, potentially leading to full device compromise.

Impact

Successful exploitation of this vulnerability grants attackers complete control over the affected Tenda F451 router. This could lead to a number of severe consequences, including: unauthorized access to the local network, data theft, malware installation, and use of the compromised router as part of a botnet. Given the simplicity of exploitation (public exploit available) and the potentially wide deployment of the affected router model, a successful attack may affect a significant number of users and small businesses.

Recommendation

• Deploy the Sigma rule "Detect Tenda F451 Stack Buffer Overflow Attempt" to detect exploitation attempts targeting the /goform/addressNat endpoint.
• Monitor webserver logs for suspicious requests with unusually long entrys parameters in the /goform/addressNat path.
• Consider blocking or rate-limiting traffic to the /goform/addressNat endpoint if legitimate use is not required.
• If possible, replace any Tenda F451 routers running firmware version 1.0.0.7 with more secure devices.