| शीर्षक | D-Link DI-8300 16.07 Buffer Overflow |
|---|
| विवरण | D-Link DI-8300 is a gigabit enterprise internet behavior management router manufactured by D-Link (Shanghai) Electronics Equipment Co., Ltd, supporting concurrent access for up to 360 corporate terminals. A stack buffer overflow vulnerability resides in the rzgl_asp function at memory address 0x44afc0 of its web management CGI service, which handles HTTP POST requests sent to the /rzgl.asp endpoint for redirect URL configuration.
The function retrieves the user-controllable redirct_url parameter via the httpd_get_parm interface without any pre-length validation. The input value is decoded via the base64_decode routine and stored into a fixed 1024-byte stack buffer named v27. Two independent exploitable overflow paths exist due to missing bounds checking and unsafe string operations:
If the Base64-decoded data starts with the http:// prefix, the raw decoded buffer v27 is directly referenced. Decoded data exceeding the 1024-byte capacity of v27 triggers an out-of-bounds write; the offset from the start of v27 to the stack’s saved return address is 1100 bytes.
If the decoded data does not carry the http:// prefix, the program uses strcpy to write the fixed string http:// into another 1024-byte stack buffer v26, then invokes unbounded strcat to append all decoded content to v26. This leaves only 1016 available bytes in v26, and oversized decoded data overflows the buffer with an offset of 2124 bytes to overwrite the return address.
Unsafe functions including unbounded strcpy and strcat are used without size restrictions, and no length limit is enforced on the original Base64 input before decoding. An authenticated remote attacker holding valid administrative web session cookies can construct malicious long Base64 payloads to overwrite critical stack metadata such as frame pointers and function return addresses. Successful exploitation enables hijacking of program execution flow, complete router device compromise, leakage of sensitive internal network configurations, persistent denial-of-service attacks, and lateral movement to other assets within the local area network. |
|---|
| स्रोत | ⚠️ https://github.com/Vivi-Xray/Xray-s-cve-/tree/main/rzgl |
|---|
| उपयोगकर्ता | Xray (UID 100597) |
|---|
| सबमिशन | 15/08/2026 06:01 PM (1 महीना पहले) |
|---|
| संयम | 14/09/2026 05:47 PM (30 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 403586 [D-Link DI-8300 16.07 CGI Service /rzgl.asp rzgl_asp redirct_url बफ़र ओवरफ़्लो] |
|---|
| अंक | 20 |
|---|