| Titel | Wavlink WAVLINK_WN535M1-M35M1_V250922 V250922 Buffer Overflow |
|---|
| Beschreibung | A stack-based buffer overflow vulnerability has been identified in WAVLINK WN535M1/M35M1 router firmware version V250922. The vulnerability exists in the CGI binary /etc/lighttpd/www/cgi-bin/export_pingortrace.cgi. The program reads the HTTP Cookie header via getenv("HTTP_COOKIE") and copies the entire value into a fixed-size 256-byte stack buffer using strcpy() without any length validation.
The strcpy() call occurs BEFORE the authentication check (token validation via ipc_send to the ioos backend), making this a pre-authentication vulnerability. No credentials are required to trigger the overflow.
By sending an HTTP GET request to /cgi-bin/export_pingortrace.cgi with a Cookie header exceeding 304 bytes, an attacker can overwrite saved registers on the MIPS stack including $s0, $s1, $s2 and the return address $ra. This allows full control of program execution flow.
Exploitation has been verified using a ret2libc technique combined with a ROP gadget in musl libc. The attacker overwrites $s1 with the address of system() and $ra with a gadget that calls system() with an attacker-controlled command string placed on the stack. This achieves unauthenticated remote code execution. |
|---|
| Quelle | ⚠️ https://github.com/wcndsb-sketch/WAVLINK_WN535M1-M35M1_V250922-Buffer-Overflow/blob/main/CVE-Report-WAVLINK-WN535M1-RCE.pdf |
|---|
| Benutzer | world5 (UID 99432) |
|---|
| Einreichung | 01.07.2026 05:57 (vor 2 Monaten) |
|---|
| Moderieren | 17.08.2026 06:49 (2 months later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 391205 [Wavlink WN531P3/WN535M1 V250922 Export Pingortrace CGI export_pingortrace.cgi strcpy HTTP_COOKIE Pufferüberlauf] |
|---|
| Punkte | 20 |
|---|