| शीर्षक | Wavlink NU516U1 V240425 Stack-based Buffer Overflow |
|---|
| विवरण | ⚠️ DISAMBIGUATION NOTICE:
NOT A DUPLICATE OF CVE-2026-2565 Please be advised that this submission is distinct from CVE-2026-2565 and should not be marked as a duplicate. While both vulnerabilities involve a stack-based buffer overflow in the time_zone parameter of the /cgi-bin/adm.cgi component for the Wavlink WL-NU516U1, they apply to different firmware builds and different function offsets:
CVE-2026-2565: Affects firmware version 20251208, with the vulnerable code located in function sub_40785C.
This Submission: Affects the distinct firmware version 20240425 (V240425), with the vulnerable code located in function sub_4071D4.
Because the memory layout, stack offsets, and underlying compiled binaries differ between these dates, the exploitation conditions are unique. Please evaluate this report based on the V240425 firmware.
Stack Buffer Overflow Vulnerability in Wavlink NU516U1 (V240425) via "time_zone" Parameter in "sub_4071D4" Function of "adm.cgi" Component
Overview
Vendor: Wavlink
Product: NU516U1
Version: WAVLINK-NU516U1-WO-A-2024-04-25-b516aec-GDBYFM (V240425)
Vulnerability Type: Stack Buffer Overflow
Product Type: USB Printer Server
Firmware Download: https://docs.wavlink.xyz/Firmware/?category=USB+Printer+Server&model=WL-NU516U1-A
Default Password: admin
Basic Vulnerability Information
Vulnerable Function: sub_4071D4 (Handles NTP and Time Zone settings)
Vulnerability Point: strcpy(v26, v4);
Trigger Parameter: time_zone (Corresponds to v4 in the code)
Prerequisite: The dstEnabled parameter must be set to "1" to enter the vulnerable if branch.
Vulnerability Description
A stack buffer overflow vulnerability exists in the sub_4071D4 function of the /cgi-bin/adm.cgi component in the Wavlink NU516U1 V240425 firmware. The function defines a fixed-size buffer v26 (16 bytes) on the stack. The program first retrieves the value of the time_zone parameter from the POST request. After confirming that dstEnabled is "1", it directly uses the strcpy function to copy the content of time_zone into the v26 buffer.
Since strcpy does not limit the length of the copy and the program does not perform any validation on the length of time_zone, an attacker can send a malicious string exceeding 16 bytes. The overflowing data will sequentially overwrite adjacent local variables on the stack (such as v27), saved registers (Saved Registers), and finally the function's return address ($ra). When the function attempts to return after execution, the CPU will jump to a memory address controlled by the attacker, leading to Remote Code Execution (RCE) or Denial of Service (DoS). |
|---|
| उपयोगकर्ता | haimianbaobao (UID 94979) |
|---|
| सबमिशन | 07/03/2026 10:38 AM (7 महीनों पहले) |
|---|
| संयम | 07/03/2026 01:13 PM (3 hours later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 346172 [Wavlink WL-NU516U1 20251208 /cgi-bin/adm.cgi sub_40785C time_zone बफ़र ओवरफ़्लो] |
|---|
| अंक | 0 |
|---|