| शीर्षक | Wavlink NU516U1 V260227 Stack-based Buffer Overflow |
|---|
| विवरण | Stack-based Buffer Overflow Vulnerability via "time_zone" Parameter in sub_407950 Function of adm.cgi Interface on Wavlink NU516U1 (V260227)
[IMPORTANT NOTICE FOR REVIEWERS: PLEASE DO NOT REJECT AS A DUPLICATE!]
This report submits a brand new "Incomplete Fix / Patch Bypass" vulnerability.
Although this vulnerability and CVE-2026-2565 both exist within the NTP setting function of adm.cgi and share the same trigger parameter (time_zone), this issue occurs in the vendor's latest patched firmware (V260227). The vendor changed the processing function in the latest version (from sub_40785C in the old version to sub_407950 in the new version) and attempted to use snprintf to fix the overflow risk at the end of the code. However, they fatally missed the strcpy overflow point at the beginning of the function. This vulnerability proves that the vendor's latest security patch is invalid, and attackers can still achieve unauthenticated (or unauthorized) remote code execution.
Vulnerability Overview
Vendor: Wavlink
Product: NU516U1
Affected Version: WINSTAR_NU516U1-WO-A-2026-02-27-2fcf6ae-mt7628-squashfs-sysupgrade (Firmware Version: M16U1_V260227) [Latest Version]
Vulnerability Type: Stack-based Buffer Overflow (Incomplete Fix / Patch Bypass)
Product Purpose: USB Printer Server
Vulnerability Entry Point: adm.cgi component
Default Login Password: admin
Vulnerability Basic Information
Vulnerable Function: sub_407950 (The function handling NTP and timezone settings in the new version)
Vulnerability Point: strcpy(v30, v4);
Trigger Parameter: time_zone (corresponds to variable v4)
Prerequisite: dstEnabled must be "1" to enter the branch containing strcpy.
Core Comparison: In-depth Analysis of the Official "Invalid Patch"
In the old version (V251208, corresponding to CVE-2026-2565), the function handling page=ntp was sub_40785C. In the latest version (V260227), the logic was migrated to sub_407950.
By comparing the decompiled pseudocode of the old and new firmware, the vendor's patching mistake is clearly visible: the developers only fixed the sprintf overflow risk at the end of the function, but completely ignored the unverified strcpy at the beginning of the function.
1. Before Patch (Old Version V251208 - Function sub_40785C):
// [Vulnerability Point 1: Unverified strcpy]
memset(v31, 0, sizeof(v31));
strcpy(v31, v4); // v4 is the user-input ultra-long time_zone string, v31 size is 16 bytes
// ... [Intermediate processing logic] ...
// [Vulnerability Point 2: Dangerous sprintf]
if ( v21 < 0 )
sprintf(v32, "UTC-%0*d:%s", 2, -v21, v16);
else
sprintf(v32, "UTC+%0*d:%s", 2, v21, v16);
2. After Patch (Latest Version V260227 - Function sub_407950):
// [Remaining Vulnerability Point: Unverified strcpy was completely untouched!]
memset(v31, 0, sizeof(v31));
memset(v30, 0, sizeof(v30));
strcpy(v30, v4); // <--- Fatal Error: The ultra-long input is still copied into the 16-byte v30 here
// ... [Intermediate processing logic] ...
// [The part the vendor considers fixed: Replaced with safe snprintf]
if ( v21 < 0 )
snprintf(v31, 16, "UTC-%0*d:%s", 2, -v21, v16); // The vendor added a 16-byte length limit
else
snprintf(v31, 16, "UTC+%0*d:%s", 2, v21, v16);
Conclusion: The official patch is completely invalid. The attacker does not even need to reach the snprintf location; the program's stack frame is already completely destroyed during the execution of strcpy(v30, v4).
Differences and Relationship with the Old Version (CVE-2026-2565)
In the old version (V251208), the processing function is sub_40785C. There were two potential overflow points in this function:
strcpy(v31, v4); at the beginning.
sprintf(v32, ...) at the end.
In this newly reported latest version (V260227), the processing function changed to sub_407950. The vendor's security developers noticed the sprintf risk at the end and replaced it with a safe snprintf(v31, 16, ...), strictly limiting the length.
However, the vendor completely missed the more direct and fatal strcpy(v30, v4) at the beginning of the function. Attackers can still construct a malicious time_zone string to directly overflow the v30 buffer, thereby hijacking the program's execution flow.
Vulnerability Description
Under the MIPS 32-bit architecture, the sub_407950 function allocates a fixed-size buffer v30 (16 bytes, defined as _DWORD v30[4]) on the stack. The program uses sub_40B48C to extract the time_zone string from the user's POST request (assigned to v4).
In the logic branch handling Daylight Saving Time (dstEnabled == "1"), the program directly calls strcpy(v30, v4) without performing any bounds checking on the length of the user-input string. An attacker can break through the boundary of v30 by sending an ultra-long string exceeding 15 bytes (reserving 1 byte for \x00), sequentially overwriting adjacent local variables and saved register values, and ultimately precisely overwriting the return address ($ra) on the stack, achieving remote code execution. |
|---|
| उपयोगकर्ता | haimianbaobao (UID 94979) |
|---|
| सबमिशन | 10/03/2026 11:21 AM (7 महीनों पहले) |
|---|
| संयम | 25/03/2026 05:24 PM (15 days later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 346172 [Wavlink WL-NU516U1 20251208 /cgi-bin/adm.cgi sub_40785C time_zone बफ़र ओवरफ़्लो] |
|---|
| अंक | 0 |
|---|