| Titre | Linksys E5600 1.1.0.26 Buffer Overflow - Out-of-bounds Write (CWE-787) |
|---|
| Description | A buffer overflow was discovered in Linksys E5600 firmware v1.1.0.26. The multipart/form-data header parser of /cgi-bin/upload_fw.cgi (init_multipart) appends attacker-controlled header lines into a 1024-byte global buffer using unbounded strcat(). A Content-Disposition line that does not contain "filename=" triggers a triple strcat of up to ~1533 bytes, and the parsing loop can be re-entered arbitrarily many times, making the overflow length attacker-controlled. The overflow was dynamically verified to crash the CGI process: a multipart POST with three crafted header blocks reliably produces HTTP 500 (process death by memory corruption) while the web server itself stays alive; a smaller overflow completes normally, confirming the vulnerable path executes. The endpoint is normally session-gated but becomes reachable without credentials via the pre-authentication session-issuance flaws in al.cgi / mesh_login.cgi. Proposed CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (6.5). Discovered by Zimo-666 via static reverse engineering and dynamic crash reproduction. |
|---|
| La source | ⚠️ https://github.com/Zimo-666/E5600-cves/tree/main/04-upload-fw-multipart-overflow |
|---|
| Utilisateur | liuyingqi (UID 102046) |
|---|
| Soumission | 10/10/2026 16:52 (il y a 27 jours) |
|---|
| Modérer | 03/11/2026 17:40 (24 days later) |
|---|
| Statut | Accepté |
|---|
| Entrée VulDB | 430465 [Linksys E5600 1.1.0.26 Header Parser /cgi-bin/upload_fw.cgi init_multipart buffer overflow] |
|---|
| Points | 20 |
|---|