| عنوان | Linksys E5600 1.1.0.26 Buffer Overflow - Out-of-bounds Write (CWE-787) |
|---|
| الوصف | A buffer overflow was discovered in Linksys E5600 firmware v1.1.0.26. The multipart/form-data header parser of /cgi-bin/upload_fw.cgi (init_multipart) appends attacker-controlled header lines into a 1024-byte global buffer using unbounded strcat(). A Content-Disposition line that does not contain "filename=" triggers a triple strcat of up to ~1533 bytes, and the parsing loop can be re-entered arbitrarily many times, making the overflow length attacker-controlled. The overflow was dynamically verified to crash the CGI process: a multipart POST with three crafted header blocks reliably produces HTTP 500 (process death by memory corruption) while the web server itself stays alive; a smaller overflow completes normally, confirming the vulnerable path executes. The endpoint is normally session-gated but becomes reachable without credentials via the pre-authentication session-issuance flaws in al.cgi / mesh_login.cgi. Proposed CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (6.5). Discovered by Zimo-666 via static reverse engineering and dynamic crash reproduction. |
|---|
| المصدر | ⚠️ https://github.com/Zimo-666/E5600-cves/tree/main/04-upload-fw-multipart-overflow |
|---|
| المستخدم | liuyingqi (UID 102046) |
|---|
| ارسال | 10/10/2026 04:52 PM (27 أيام منذ) |
|---|
| الاعتدال | 03/11/2026 05:40 PM (24 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 430465 [Linksys E5600 1.1.0.26 Header Parser /cgi-bin/upload_fw.cgi init_multipart تلف الذاكرة] |
|---|
| النقاط | 20 |
|---|