| शीर्षक | Tomato by Shibby Tomato Firmware Tomato PL ND 1.28 beta Stack-based Buffer Overflow |
|---|
| विवरण | sub_42537C builds a cru a ... scheduler command in a fixed 64-byte stack buffer. The scheduler name argument a1 is inserted into the formatted string twice and is then executed through system().
char cmd[64];
cfg = nvram_get(a1);
sscanf(cfg, "%d,%d,%d", &enabled, &time, &days);
sprintf(cmd, "cru a %s \"%d %d * * %s sched %s\"",
a1, minute, hour, days, a1);
system(cmd);
Two alternate scheduling formats use the same pattern and also place a1 into cmd twice. If a1 is sufficiently long, the formatted command can overflow the 64-byte stack buffer and overwrite saved registers, including the saved return address in the demonstrated layout. |
|---|
| स्रोत | ⚠️ https://gitee.com/Fengyi-Wang/CVE/issues/IJTQ5U |
|---|
| उपयोगकर्ता | Cormac315 (UID 97273) |
|---|
| सबमिशन | 10/06/2026 04:24 PM (1 महीना पहले) |
|---|
| संयम | 17/07/2026 04:14 PM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 379801 [Shibby Tomato 1.28 Scheduler Name sub_42537C a1 बफ़र ओवरफ़्लो] |
|---|
| अंक | 20 |
|---|