| शीर्षक | Wavlink NU516U1 V240425 Stack-based Buffer Overflow |
|---|
| विवरण | # Stack Buffer Overflow Vulnerability in Wavlink NU516U1 (V240425) via "time_zone" Parameter in "sub_4071D4" Function of "adm.cgi" Component
#### Overview
- **Vendor:** Wavlink
- **Product:** NU516U1
- **Version:** WAVLINK-NU516U1-WO-A-2024-04-25-b516aec-GDBYFM (V240425)
- **Vulnerability Type:** Stack Buffer Overflow
- **Product Type:** USB Printer Server
- **Firmware Download:** `https://docs.wavlink.xyz/Firmware/?category=USB+Printer+Server&model=WL-NU516U1-A`
- **Default Password:** admin
#### Basic Vulnerability Information
- **Vulnerable Function:** `sub_4071D4` (Handles NTP and Time Zone settings)
- **Vulnerability Point:** `strcpy(v26, v4);`
- **Trigger Parameter:** `time_zone` (Corresponds to `v4` in the code)
- **Prerequisite:** The `dstEnabled` parameter must be set to "1" to enter the vulnerable `if` branch.
#### Vulnerability Description
A stack buffer overflow vulnerability exists in the `sub_4071D4` function of the `/cgi-bin/adm.cgi` component in the Wavlink NU516U1 V240425 firmware. The function defines a fixed-size buffer `v26` (16 bytes) on the stack. The program first retrieves the value of the `time_zone` parameter from the POST request. After confirming that `dstEnabled` is "1", it directly uses the `strcpy` function to copy the content of `time_zone` into the `v26` buffer.
Since `strcpy` does not limit the length of the copy and the program does not perform any validation on the length of `time_zone`, an attacker can send a malicious string exceeding 16 bytes. The overflowing data will sequentially overwrite adjacent local variables on the stack (such as `v27`), saved registers (Saved Registers), and finally the function's return address (`$ra`). When the function attempts to return after execution, the CPU will jump to a memory address controlled by the attacker, leading to Remote Code Execution (RCE) or Denial of Service (DoS). |
|---|
| उपयोगकर्ता | haimianbaobao (UID 94979) |
|---|
| सबमिशन | 09/02/2026 03:27 PM (8 महीनों पहले) |
|---|
| संयम | 05/03/2026 07:20 PM (24 days later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 346172 [Wavlink WL-NU516U1 20251208 /cgi-bin/adm.cgi sub_40785C time_zone बफ़र ओवरफ़्लो] |
|---|
| अंक | 0 |
|---|