| Título | Wavlink NU516U1 V240425 Stack-based Buffer Overflow |
|---|
| Descripción | # Stack Buffer Overflow Vulnerability in Wavlink NU516U1 (V240425) login.cgi via "ipaddr" Parameter in sub_401A0C
#### Overview
- **Vendor:** Wavlink
- **Product:** NU516U1
- **Version:** WAVLINK-NU516U1-WO-A-2024-04-25-b516aec-GDBYFM (V240425)
- **Type:** Stack Buffer Overflow
- **Product Purpose:** USB Printer Server / Wireless Router
- **Firmware Download:**https://docs.wavlink.xyz/Firmware/?category=USB+Printer+Server&model=WL-NU516U1-A
- **Default Login Password:** admin
#### Basic Vulnerability Information
- **Vulnerable Function:** `sub_401A0C` (Handles the `sys_login1` interface)
- **Vulnerable Point:** `sprintf(v15, "web 2860 sys addUser \"%s\"", v4);`
- **Trigger Parameter:** `ipaddr` (Corresponds to `v4` in the code)
- **Prerequisites:** The submitted `password` parameter must match the MD5 hash of the administrator password.
#### Vulnerability Description
In the Wavlink NU516U1 firmware (version V240425), the `sub_401A0C` function within the `/cgi-bin/login.cgi` component contains a stack buffer overflow vulnerability. This function is primarily responsible for handling requests to the `sys_login1` page.
Internally, the function defines a fixed-size buffer `v15` of 128 bytes on the stack. After successfully verifying the MD5 hash of the password, the program uses the `sprintf` function to construct a system command, directly concatenating the user-supplied `ipaddr` parameter into this buffer. Since `sprintf` does not limit the length of the data written, and the program does not validate the length of the `ipaddr` input, an attacker can send an excessively long string (exceeding approximately 105 bytes).
When the oversized `ipaddr` data is written to `v15`, an out-of-bounds write occurs, overwriting adjacent local variables on the stack, Saved Registers, and the function's Return Address (`$ra`). This causes the CGI process to crash (Segmentation Fault), resulting in a Denial of Service (DoS). Under specific conditions, this could potentially be exploited to achieve Remote Code Execution (RCE). |
|---|
| Fuente | ⚠️ https://github.com/Wlz1112/WAVLINK-NU516-V240425/blob/main/ipaddr_Stack%20Buffer%20Overflow.md |
|---|
| Usuario | haimianbaobao (UID 94979) |
|---|
| Sumisión | 2026-02-10 15:43 (hace 6 meses) |
|---|
| Moderación | 2026-03-05 19:21 (23 days later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 349221 [Wavlink WL-NU516U1 V240425 /cgi-bin/login.cgi sub_401A0C ipaddr desbordamiento de búfer] |
|---|
| Puntos | 20 |
|---|