| Titolo | D-Link DIR-878 1.20B05 Heap-based Buffer Overflow |
|---|
| Descrizione | A heap-based buffer overflow vulnerability was discovered in D-Link DIR-878 (REV A) firmware v1.20B05. The GetCAPTCHAsetting HNAP handler in bin/prog.cgi copies the attacker-controlled uid value from the HTTP Cookie header into an 11-byte heap allocation (malloc(0xb)) using strcpy, without any length check. The endpoint serves the login page and is reachable without authentication. Reproduction: curl -X POST /HNAP1/ with SOAPAction GetCAPTCHAsetting and Cookie uid=<512 bytes> returns HTTP 500 and crashes the FastCGI worker (SIGSEGV), while a short uid returns 200 OK; the crash threshold at ~11 bytes matches the malloc(0xb) size. An unauthenticated adjacent-network attacker can repeatedly crash the web management interface. The overflowed bytes are fully attacker-controlled, so heap metadata corruption and further code execution are plausible but were not developed. Proposed CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (6.5). Discovered by Zimo-666 via static reverse engineering and dynamic differential testing. |
|---|
| Fonte | ⚠️ https://github.com/Zimo-666/DIR-878-cves/tree/main/01-captcha-uid-heap-overflow |
|---|
| Utente | ha ha-yang (UID 102151) |
|---|
| Sottomissione | 15/10/2026 09:44 (24 giorni fa) |
|---|
| Moderazione | 08/11/2026 15:47 (24 days later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 432892 [D-Link DIR-878 1.20B05 HNAP bin/prog.cgi GetCAPTCHAsetting uid buffer overflow] |
|---|
| Punti | 20 |
|---|