| Titel | D-Link DI-8400 16.07 Buffer Overflow |
|---|
| Beschreibung | D-Link DI-8400 is a gigabit enterprise internet behavior management router manufactured by D-Link (Shanghai) Electronics Equipment Co., Ltd, designed for medium and large corporate network environments. Equipped with full gigabit Ethernet ports and a dedicated network processor, the device supports concurrent access by up to 360 end users.
A binary stack buffer overflow vulnerability exists within the web management service of the D-Link DI-8400 router. The vulnerable logic resides in the ddns_asp function at memory address 0x41f82c, which handles HTTP POST requests submitted to the /ddns.asp endpoint for DDNS configuration updates.
Inside the vulnerable function, the program retrieves eight user-controllable HTTP request parameters (serv, user, host, wild, mx, bmx, cust, ip) via the httpd_get_parm routine. This upstream parameter acquisition function only performs URL decoding and implements no input length restrictions. The code then invokes the unsafe sprintf() function to concatenate all eight user-supplied strings with vertical bar | separators and writes the combined result into a fixed-size stack buffer named v18, which has a static capacity of 1024 bytes.
Since sprintf() does not enforce any boundary limit on write operations, the total length of concatenated parameter data (including separating | characters) can easily exceed the 1024-byte buffer limit. This out-of-bounds write triggers a stack buffer overflow, corrupting adjacent stack memory such as local variables, stack frame pointers, and the function return address. An authenticated remote attacker who can send crafted POST requests to the DDNS configuration interface may leverage this flaw to overwrite critical stack metadata, hijack program execution flow, crash the router device, or potentially execute arbitrary binary code on the target hardware. |
|---|
| Quelle | ⚠️ https://github.com/Vivi-Xray/Xray-s-cve-/tree/main/ddns_asp |
|---|
| Benutzer | Xray (UID 100597) |
|---|
| Einreichung | 15.08.2026 16:14 (vor 1 Monat) |
|---|
| Moderieren | 14.09.2026 17:35 (1 month later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 403582 [D-Link DI-8400 16.07 DDNS Configuration /ddns.asp ddns_asp serv/user/host/wild/mx/bmx/cust/ip Pufferüberlauf] |
|---|
| Punkte | 20 |
|---|