CVE-2020-14077 in TEW-827DRU
Summary
by MITRE
TRENDnet TEW-827DRU devices through 2.06B04 contain a stack-based buffer overflow in the ssi binary. The overflow allows an authenticated user to execute arbitrary code by POSTing to apply.cgi via the action set_sta_enrollee_pin_wifi1 (or set_sta_enrollee_pin_wifi0) with a sufficiently long wps_sta_enrollee_pin key.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 06/15/2020
The TRENDnet TEW-827DRU wireless router firmware version 2.06B04 contains a critical stack-based buffer overflow vulnerability in the ssi binary component. This vulnerability affects devices running firmware versions up to and including 2.06B04, making them susceptible to remote code execution attacks. The flaw resides in the web application interface handling of WPS configuration parameters, specifically within the apply.cgi script that processes administrative requests. The vulnerability is particularly concerning because it requires only authentication to exploit, meaning an attacker who can obtain valid credentials can execute arbitrary code on the affected device with the privileges of the web server process.
The technical implementation of this vulnerability stems from improper input validation within the ssi binary when processing the set_sta_enrollee_pin_wifi1 or set_sta_enrollee_pin_wifi0 parameters. These parameters are used to configure WPS (Wi-Fi Protected Setup) functionality for wireless networks, but the firmware fails to properly bounds-check the wps_sta_enrollee_pin key value before copying it into a fixed-size stack buffer. When an authenticated user submits a POST request to apply.cgi with a sufficiently long wps_sta_enrollee_pin value, the excessive input overflows the allocated stack space, potentially overwriting adjacent memory locations including return addresses and control data. This memory corruption enables attackers to manipulate the program execution flow and execute malicious code within the router's memory space.
The operational impact of this vulnerability extends beyond simple code execution, as it provides attackers with persistent access to the network infrastructure. Once exploited, the attacker can gain full administrative control over the router, enabling them to modify network configurations, intercept traffic, redirect DNS requests, or establish backdoor access points. The vulnerability affects both wireless interfaces (wifi0 and wifi1) of the device, providing multiple attack vectors for exploitation. Additionally, since the device is designed for home and small office use, it often operates behind NAT firewalls, making it a potential entry point for attackers seeking to establish persistent access to internal networks. The authentication requirement does not prevent exploitation as credentials are often weak or reused across multiple devices, and social engineering attacks can easily obtain valid login information.
Mitigation strategies for this vulnerability should include immediate firmware updates from TRENDnet to address the buffer overflow in the ssi binary component. Network administrators should also implement network segmentation to limit the potential impact of exploitation, deploy intrusion detection systems to monitor for suspicious POST requests to apply.cgi, and enforce strong authentication practices including multi-factor authentication. The vulnerability aligns with CWE-121 Stack-based Buffer Overflow, which is classified as a high-severity issue in the Common Weakness Enumeration catalog, and maps to ATT&CK technique T1059.007 Command and Scripting Interpreter: Unix Shell for the execution phase of the attack. Organizations should also consider implementing network access controls to restrict access to administrative interfaces and regularly audit device configurations to ensure proper security hardening. Given the nature of the vulnerability and its potential for persistent network access, organizations should treat this as a critical security issue requiring immediate remediation.