| عنوان | Linksys E5600 1.1.0.26 Buffer Overflow - Out-of-bounds Write (CWE-787) |
|---|
| الوصف | Multiple global buffer overflows were discovered in Linksys E5600 firmware v1.1.0.26. The JSON request parser of /cgi-bin/mesh_login.cgi copies six attacker-controlled string fields into fixed-size global buffers using unbounded strcpy(): username (130 bytes), password (130 bytes), token (64 bytes), source (6 bytes), cn (16 bytes) and action (16 bytes). Any over-long JSON field overwrites adjacent global variables and subsequent .bss data, including security-relevant fields evaluated by the login routine and a saved copy of the request object pointer. The endpoint is reachable without authentication. Reproduction: POST a JSON body with a 2000-byte "source" value to /cgi-bin/mesh_login.cgi. In the tested rehosted environment the out-of-bounds write executes unconditionally (statically evident) while the corruption lands in slack .bss without an observed crash in the tested code path; impact on production devices depends on the exact .bss layout. Proposed CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N (3.5, conservative). Discovered by Zimo-666 via static reverse engineering and dynamic probing. |
|---|
| المصدر | ⚠️ https://github.com/Zimo-666/E5600-cves/tree/main/03-mesh-login-global-overflow |
|---|
| المستخدم | liuyingqi (UID 102046) |
|---|
| ارسال | 10/10/2026 04:51 PM (27 أيام منذ) |
|---|
| الاعتدال | 03/11/2026 05:40 PM (24 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 430464 [Linksys E5600 1.1.0.26 JSON Request Parser /cgi-bin/mesh_login.cgi strcpy username/password/token/source/cn/action تلف الذاكرة] |
|---|
| النقاط | 20 |
|---|