Key Information Summary Vulnerability Overview Vulnerability Type: Remote Code Execution (RCE) Affected Device: Tenda FH451 Router (Version V1.0.0.9) Manufacturer: Shenzhen Tenda Technology Co., Ltd. Vulnerability Analysis Location: In the function Issue Description: - The program retrieves input from the URL parameter but does not validate its length. - When the input parameter is excessively long, it causes a stack overflow, leading to program crash or potential code execution. Vulnerability Details Critical Code Snippet: Exploitation Payload: Reproduction Steps Environment: QEMU Emulator Results: - Router crashes, web interface becomes inaccessible. - String "Hello, world" is printed, indicating that the function was successfully executed. Conclusion The vulnerability allows attackers to trigger a stack overflow by crafting a specific HTTP request, potentially leading to arbitrary code execution. Upon successful exploitation, the router becomes unavailable, and attackers can execute arbitrary commands on the device.