| शीर्षक | Wavlink WAVLINK_WN535M1-M35M1_V250922 V250922 Buffer Overflow |
|---|
| विवरण | A stack-based buffer overflow vulnerability has been identified in WAVLINK WN535M1/M35M1 router firmware version V250922. The vulnerability exists in the CGI binary /etc/lighttpd/www/cgi-bin/export_pingortrace.cgi. The program reads the HTTP Cookie header via getenv("HTTP_COOKIE") and copies the entire value into a fixed-size 256-byte stack buffer using strcpy() without any length validation.
The strcpy() call occurs BEFORE the authentication check (token validation via ipc_send to the ioos backend), making this a pre-authentication vulnerability. No credentials are required to trigger the overflow.
By sending an HTTP GET request to /cgi-bin/export_pingortrace.cgi with a Cookie header exceeding 304 bytes, an attacker can overwrite saved registers on the MIPS stack including $s0, $s1, $s2 and the return address $ra. This allows full control of program execution flow.
Exploitation has been verified using a ret2libc technique combined with a ROP gadget in musl libc. The attacker overwrites $s1 with the address of system() and $ra with a gadget that calls system() with an attacker-controlled command string placed on the stack. This achieves unauthenticated remote code execution. |
|---|
| स्रोत | ⚠️ https://github.com/wcndsb-sketch/WAVLINK_WN535M1-M35M1_V250922-Buffer-Overflow/blob/main/CVE-Report-WAVLINK-WN535M1-RCE.pdf |
|---|
| उपयोगकर्ता | world5 (UID 99432) |
|---|
| सबमिशन | 01/07/2026 05:57 AM (2 महीनों पहले) |
|---|
| संयम | 17/08/2026 06:49 AM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 391205 [Wavlink WN531P3/WN535M1 V250922 Export Pingortrace CGI export_pingortrace.cgi strcpy HTTP_COOKIE बफ़र ओवरफ़्लो] |
|---|
| अंक | 20 |
|---|