CVE-2021-27705

Name of the Vulnerable Software and Affected Versions: Tenda G1 and G3 routers version v15.11.0.17(9502) CN

Description: A buffer overflow issue allows remote attackers to execute arbitrary code via a crafted action/"qosIndex " request. This occurs because the formQOSRuleDel function directly passes the parameter qosIndex to strcpy without limit.

Recommendations: For Tenda G1 and G3 routers version v15.11.0.17(9502) CN, as a temporary workaround, consider disabling the formQOSRuleDel function until a patch is available. Restrict access to the API endpoint that handles the "qosIndex" request to minimize the risk of exploitation. Avoid using the parameter qosIndex in the affected API endpoint until the issue is resolved.