| Título | TRENDnet TEW-657BRM 1.00.1 Stack-based Buffer Overflow |
|---|
| Descripción | A stack-based buffer overflow vulnerability was identified in TRENDnet TEW-657BRM firmware 1.00.1 (hardware revision v1.0R).
The vulnerability exists in the firmware upgrade handler /usr/sbin/upgrade_flash.cgi, which processes multipart HTTP upload requests.
The handler extracts a boundary value from the first line of the multipart request body and copies it into a fixed-size 128-byte stack buffer using strncpy. The copy length is derived from an attacker-controlled delimiter position without adequate bounds checking.
An authenticated attacker with access to the device's web management interface can supply an oversized multipart boundary, potentially overwriting adjacent stack memory, saved registers, and the saved return address.
Static analysis of the original firmware identified the vulnerable copy operation. In a re-hosted QEMU-MIPS environment, testing demonstrated a process crash, saved return-address corruption, and program-counter control with PC=0x5758595a when the firmware-update success path returned.
The emulation environment required documented modifications to certain hardware-dependent LAN, firmware validation, checksum, and shutdown operations. The vulnerable strncpy operation itself was not modified.
The observed impact is stack memory corruption with demonstrated control-flow hijacking in the stated emulation environment. Arbitrary code execution on physical hardware has not been demonstrated.
Affected vendor: TRENDnet
Affected product: TEW-657BRM
Hardware revision: v1.0R
Affected firmware: 1.00.1
Affected component: upgrade_flash.cgi
Vulnerability type: Stack-based Buffer Overflow
CWE: CWE-121
Attack vector: HTTP firmware upload
Authentication required: Yes
Testing environment: Re-hosted QEMU-MIPS
This vulnerability affects the firmware upgrade handler and has a different root cause from previously disclosed setup.cgi vulnerabilities and the mini_httpd redirect buffer overflow.
|
|---|
| Fuente | ⚠️ https://github.com/ruanyi101/router-firmware-security-advisories/blob/main/router-firmware-GitHub-advisories/advisories/TRENDnet-TEW-657BRM-upgrade_flash.md |
|---|
| Usuario | ruanyi (UID 102203) |
|---|
| Sumisión | 2026-10-19 16:55 (hace 26 días) |
|---|
| Moderación | 2026-11-14 07:31 (26 days later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 437398 [TRENDnet TEW-657BRM 1.00.1 upgrade_flash.cgi boundary desbordamiento de búfer] |
|---|
| Puntos | 20 |
|---|