| Titre | D-Link DIR-878 1.20B05 Stack-based Buffer Overflow |
|---|
| Description | A stack-based buffer overflow vulnerability was discovered in D-Link DIR-878 (REV A) firmware v1.20B05. The SetVLANSettings HNAP handler stores the user-controlled VLANID:0/VID field without any length check into the nvram key wan_wan0_ifname (up to 255 bytes). The SetTriggerADIC handler (0x459b60) then concatenates that stored value with sprintf into a 128-byte stack buffer to build pppoe-discovery and udhcpc-discovery command lines. A purely alphanumeric VID of 98+ characters overflows the stack frame; no shell metacharacters are needed, so metacharacter filtering cannot fix this defect. The command-injection facet of the same field is covered by CVE-2024-48636 and is not claimed here. The handlers are reachable pre-authentication via the previously disclosed HNAP bypass (CVE-2020-15633 class), verified on v1.20B05. Reproduction: SetVLANSettings with VID="1"+150x"D" returns OK and stores the value; a subsequent SetTriggerADIC with TriggerADIC=true returns HTTP 500, the prog.cgi FastCGI worker dies (core dump attributed to prog.cgi), and the downstream udhcpc-discovery process also crashes. An unauthenticated adjacent-network attacker can repeatedly crash the web management handler and disrupt WAN services; the overwrite reaches the saved return-address area, giving code-execution potential that was not further developed. Proposed CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (6.5). Discovered by Zimo-666 via static reverse engineering and dynamic end-to-end reproduction with core attribution. |
|---|
| La source | ⚠️ https://github.com/Zimo-666/DIR-878-cves/tree/main/03-settriggeradic-vlan-stack-overflow |
|---|
| Utilisateur | ha ha-yang (UID 102151) |
|---|
| Soumission | 15/10/2026 09:45 (il y a 25 jours) |
|---|
| Modérer | 08/11/2026 15:47 (24 days later) |
|---|
| Statut | Accepté |
|---|
| Entrée VulDB | 432893 [D-Link DIR-878 1.20B05 HNAP prog.cgi SetVLANSettings VID buffer overflow] |
|---|
| Points | 20 |
|---|