| عنوان | D-Link DIR-600L 2.17b02 Stack-based Buffer Overflow |
|---|
| الوصف | A pre-authentication stack-based buffer overflow vulnerability was identified in D-Link DIR-600L hardware revision B, firmware 2.17b02.
The vulnerability exists in the authentication.cgi login handler within the htdocs/cgibin executable.
The handler processes user-controlled id and password parameters using unbounded strcpy operations to copy these values into fixed-size stack buffers before authentication is completed.
An unauthenticated attacker with access to the router's web management interface can provide an excessively long login parameter, causing adjacent stack memory to be overwritten.
Static analysis of the firmware identified the unsafe string-copy operations in the authenticationcgi_main function.
In a re-hosted QEMU-MIPSEL environment, a crafted unauthenticated HTTP request containing an oversized id parameter caused the CGI child process to terminate with SIGSEGV.
The captured host-side strace recorded:
SIGSEGV, SEGV_ACCERR, si_addr=0x47474747
The attacker-influenced fault address is consistent with memory corruption. However, the si_addr value alone does not establish the exact program-counter register value or prove arbitrary code execution.
The demonstrated impact is memory corruption and a crash of the CGI child process. Code execution on physical router hardware has not been demonstrated.
Affected vendor: D-Link
Affected product: DIR-600L
Hardware revision: B
Affected firmware: 2.17b02
Affected component: authentication.cgi
Vulnerability type: Stack-based Buffer Overflow
CWE: CWE-121
Attack vector: HTTP login request
Authentication required: No
Testing environment: Re-hosted QEMU-MIPSEL
This vulnerability affects the login parameter handling code and requires separate assessment from previously reported login-related vulnerabilities in other D-Link firmware versions.
|
|---|
| المصدر | ⚠️ https://github.com/ruanyi101/router-firmware-security-advisories/blob/main/router-firmware-GitHub-advisories/advisories/D-Link-DIR-600L-authentication-cgi.md |
|---|
| المستخدم | ruanyi (UID 102203) |
|---|
| ارسال | 19/10/2026 04:58 PM (26 أيام منذ) |
|---|
| الاعتدال | 14/11/2026 07:38 AM (26 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 437416 [D-Link DIR-600L 2.17/2.17b02 authentication.cgi authenticationcgi_main id/password تلف الذاكرة] |
|---|
| النقاط | 20 |
|---|