| Título | Wavlink NU516U1 V240425 Stack-based Buffer Overflow |
|---|
| Descripción | # Stack Buffer Overflow Vulnerability in Wavlink NU516U1 (V240425) via "time_zone" Parameter in "sub_4071D4" Function of "adm.cgi" Component
#### Overview
- **Vendor:** Wavlink
- **Product:** NU516U1
- **Version:** WAVLINK-NU516U1-WO-A-2024-04-25-b516aec-GDBYFM (V240425)
- **Vulnerability Type:** Stack Buffer Overflow
- **Product Type:** USB Printer Server
- **Firmware Download:** `https://docs.wavlink.xyz/Firmware/?category=USB+Printer+Server&model=WL-NU516U1-A`
- **Default Password:** admin
#### Basic Vulnerability Information
- **Vulnerable Function:** `sub_4071D4` (Handles NTP and Time Zone settings)
- **Vulnerability Point:** `strcpy(v26, v4);`
- **Trigger Parameter:** `time_zone` (Corresponds to `v4` in the code)
- **Prerequisite:** The `dstEnabled` parameter must be set to "1" to enter the vulnerable `if` branch.
#### Vulnerability Description
A stack buffer overflow vulnerability exists in the `sub_4071D4` function of the `/cgi-bin/adm.cgi` component in the Wavlink NU516U1 V240425 firmware. The function defines a fixed-size buffer `v26` (16 bytes) on the stack. The program first retrieves the value of the `time_zone` parameter from the POST request. After confirming that `dstEnabled` is "1", it directly uses the `strcpy` function to copy the content of `time_zone` into the `v26` buffer.
Since `strcpy` does not limit the length of the copy and the program does not perform any validation on the length of `time_zone`, an attacker can send a malicious string exceeding 16 bytes. The overflowing data will sequentially overwrite adjacent local variables on the stack (such as `v27`), saved registers (Saved Registers), and finally the function's return address (`$ra`). When the function attempts to return after execution, the CPU will jump to a memory address controlled by the attacker, leading to Remote Code Execution (RCE) or Denial of Service (DoS). |
|---|
| Usuario | haimianbaobao (UID 94979) |
|---|
| Sumisión | 2026-02-09 15:27 (hace 8 meses) |
|---|
| Moderación | 2026-03-05 19:20 (24 days later) |
|---|
| Estado | Duplicado |
|---|
| Entrada de VulDB | 346172 [Wavlink WL-NU516U1 20251208 /cgi-bin/adm.cgi sub_40785C time_zone desbordamiento de búfer] |
|---|
| Puntos | 0 |
|---|