| Titel | TOTOLINK A950RG V4.1.2cu.5268_B20221104 Stack Buffer Overflow |
|---|
| Beschreibung | The basic wireless configuration handler of the TOTOLINK A950RG copies a request parameter into a 68-byte stack buffer without checking its length. The handler is entered by posting to setting/setWiFiBasicConfig with a non-zero addEffect value, which selects the write branch; the wireless parameters are then read with websGetVar, which returns a pointer into the parsed JSON body with no length limit and no character filtering. The WEP key is read into s_3 at 0xB8A4 and is then either converted to hexadecimal or, when the key-format flag is not set, copied with strcpy(dest, s_3) at 0xBF6C. dest is a 68-byte local at [sp+0x144] and the handler frame is 440 bytes with the saved return address at [sp+0x1B4], so a wepkey value of 113 bytes or more overwrites the saved return address. The preceding memset(dest, 0, 32) clears only the first 32 bytes and does not bound the copy in any way. The buffer is destined for apmib_set(25, ...) as the WEP key, so a value longer than the buffer is not merely malformed input — it is the value the code is about to write into the wireless configuration. The target is a non-PIE MIPS32 shared object built without stack protection, and the firmware runs without ASLR, so a payload that reaches the saved return address can be aimed at a fixed address. |
|---|
| Quelle | ⚠️ https://gist.github.com/H3rmesk1t/e283a4f3224cbd0a57d4392de60bd2c6 |
|---|
| Benutzer | LiuYijun_JX.SGCC (UID 102035) |
|---|
| Einreichung | 10.10.2026 04:05 (vor 25 Tagen) |
|---|
| Moderieren | 03.11.2026 17:14 (25 days later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 430440 [TOTOLINK A950RG 4.1.2cu.5268_B20221104 Basic Wireless Configuration /cgi-bin/cstecgi.cgi strcpy wepkey Pufferüberlauf] |
|---|
| Punkte | 20 |
|---|