| Titre | D-Link DIR-878 1.20B05 Heap-based Buffer Overflow |
|---|
| Description | A heap-based buffer overflow vulnerability was discovered in D-Link DIR-878 (REV A) firmware v1.20B05. The GetCAPTCHAsetting HNAP handler in bin/prog.cgi copies the attacker-controlled uid value from the HTTP Cookie header into an 11-byte heap allocation (malloc(0xb)) using strcpy, without any length check. The endpoint serves the login page and is reachable without authentication. Reproduction: curl -X POST /HNAP1/ with SOAPAction GetCAPTCHAsetting and Cookie uid=<512 bytes> returns HTTP 500 and crashes the FastCGI worker (SIGSEGV), while a short uid returns 200 OK; the crash threshold at ~11 bytes matches the malloc(0xb) size. An unauthenticated adjacent-network attacker can repeatedly crash the web management interface. The overflowed bytes are fully attacker-controlled, so heap metadata corruption and further code execution are plausible but were not developed. Proposed CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (6.5). Discovered by Zimo-666 via static reverse engineering and dynamic differential testing. |
|---|
| La source | ⚠️ https://github.com/Zimo-666/DIR-878-cves/tree/main/01-captcha-uid-heap-overflow |
|---|
| Utilisateur | ha ha-yang (UID 102151) |
|---|
| Soumission | 15/10/2026 09:44 (il y a 25 jours) |
|---|
| Modérer | 08/11/2026 15:47 (24 days later) |
|---|
| Statut | Accepté |
|---|
| Entrée VulDB | 432892 [D-Link DIR-878 1.20B05 HNAP bin/prog.cgi GetCAPTCHAsetting uid buffer overflow] |
|---|
| Points | 20 |
|---|