Soumettre #977224: TOTOLINK A3002MU V1.0.0-B20230403.1455 Stack-based Buffer Overflow

The QoS rule handler of the TOTOLINK A3002MU contains two unbounded copies into the same 188-byte stack buffer. The handler is entered by posting to /boafrm/formIpQoS with a non-empty addQos field. The comment parameter, which is intended to hold a short human-readable label for the rule, and the entry_name parameter, which names the rule entry, are both read through the generic getter sub_4101C8 and are both copied with strcpy() into a single 188-byte destination that was cleared with memset() at the top of the function. Neither copy is preceded by a length check. The entry_name value is compared against existing entries with memcmp and strlen before the copy, but those comparisons do not bound the value. The getter accepts up to 4096 bytes and performs URL decoding only, so both parameters allow a value far larger than the destination. The frame is 760 bytes in total and the saved return address is stored at [sp+0x2F4], 504 bytes above the start of the buffer, so a parameter of 508 bytes overwrites it completely, and the remaining 3.5 KB of the parameter allowance is available for a return-oriented chain. Because the executable is a non-PIE MIPS32 little-endian binary at a fixed load address, with no stack canary and with address-space layout randomisation disabled, the overwrite is deterministic and can be developed into arbitrary code execution in the context of the web server, which runs as root; at minimum it causes a reliable crash that takes the management interface down until the watchdog restarts the daemon.

• La source: ⚠️ https://gist.github.com/H3rmesk1t/b68352b011bc2825adc85cf336c25dfb
• Utilisateur: H3rmesk1t (UID 70306)
• Soumission: 14/09/2026 11:01 (il y a 21 jours)
• Modérer: 05/10/2026 00:18 (21 days later)
• Statut: Accepté
• Entrée VulDB: 413466 [Totolink A3002MU 1.0.0-B20230403.1455 QoS Rule /boafrm/formIpQoS addQos/comment/entry_name buffer overflow]
• Points: 20