| Titolo | Linksys E5600 1.1.0.26 Buffer Overflow - Out-of-bounds Write (CWE-787) |
|---|
| Descrizione | Multiple global buffer overflows were discovered in Linksys E5600 firmware v1.1.0.26. The JSON request parser of /cgi-bin/mesh_login.cgi copies six attacker-controlled string fields into fixed-size global buffers using unbounded strcpy(): username (130 bytes), password (130 bytes), token (64 bytes), source (6 bytes), cn (16 bytes) and action (16 bytes). Any over-long JSON field overwrites adjacent global variables and subsequent .bss data, including security-relevant fields evaluated by the login routine and a saved copy of the request object pointer. The endpoint is reachable without authentication. Reproduction: POST a JSON body with a 2000-byte "source" value to /cgi-bin/mesh_login.cgi. In the tested rehosted environment the out-of-bounds write executes unconditionally (statically evident) while the corruption lands in slack .bss without an observed crash in the tested code path; impact on production devices depends on the exact .bss layout. Proposed CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N (3.5, conservative). Discovered by Zimo-666 via static reverse engineering and dynamic probing. |
|---|
| Fonte | ⚠️ https://github.com/Zimo-666/E5600-cves/tree/main/03-mesh-login-global-overflow |
|---|
| Utente | liuyingqi (UID 102046) |
|---|
| Sottomissione | 10/10/2026 16:51 (27 giorni fa) |
|---|
| Moderazione | 03/11/2026 17:40 (24 days later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 430464 [Linksys E5600 1.1.0.26 JSON Request Parser /cgi-bin/mesh_login.cgi strcpy username/password/token/source/cn/action buffer overflow] |
|---|
| Punti | 20 |
|---|