On top of that, if one really needs to use C, then:
- Enable all warnings as errors
- Sanitize all inputs via assertions, or similar
- Provide proper unit tests
- Have a static analyzer configured for the continuous build that breaks the build if issues are found
- Specially don't allow anything to go through the static analyzer that is labeled as undefined or compiler specific according to the ANSI/ISO C standard
- Read MISRA C
Well, its not quite that easy for a rookie as you say. Just because you can trigger a buffer overflow bug does not mean you can exploit it. Most modern processors will allow disabling execution with an IP-on-Stack test. Thats assuming you can actually control the IP... , and assuming you can actually deliver the payload in the corrupted program state and not crash the program, etc etc..
Even a rookie would spot this mistake, but he would need to learn a lot before exploiting it. But with a nice target like this one... :)
I don't agree that this is a valuable target. AFAIK most consumer routers disable access to the web interface from outside the LAN range (by default).
And now your weakest device can CSRF remote access back on.
Most people don't take their router in to a repair shop when the get a virus on their computer.
Yes but you can break almost any routers wifi password in 24hrs.
Even a rookie would spot such mistake and exploit it, it's always among the first obstacles to bypass at local CTFs and it's the #1 exploit that people think about when they think about a "security vulnerability".