| Titolo | D-Link DIR-878 1.20B05 Stack-based Buffer Overflow |
|---|
| Descrizione | A stack-based buffer overflow vulnerability was discovered in D-Link DIR-878 (REV A) firmware v1.20B05. The SetVLANSettings HNAP handler stores the user-controlled VLANID:0/VID field without any length check into the nvram key wan_wan0_ifname (up to 255 bytes). The SetTriggerADIC handler (0x459b60) then concatenates that stored value with sprintf into a 128-byte stack buffer to build pppoe-discovery and udhcpc-discovery command lines. A purely alphanumeric VID of 98+ characters overflows the stack frame; no shell metacharacters are needed, so metacharacter filtering cannot fix this defect. The command-injection facet of the same field is covered by CVE-2024-48636 and is not claimed here. The handlers are reachable pre-authentication via the previously disclosed HNAP bypass (CVE-2020-15633 class), verified on v1.20B05. Reproduction: SetVLANSettings with VID="1"+150x"D" returns OK and stores the value; a subsequent SetTriggerADIC with TriggerADIC=true returns HTTP 500, the prog.cgi FastCGI worker dies (core dump attributed to prog.cgi), and the downstream udhcpc-discovery process also crashes. An unauthenticated adjacent-network attacker can repeatedly crash the web management handler and disrupt WAN services; the overwrite reaches the saved return-address area, giving code-execution potential that was not further developed. Proposed CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (6.5). Discovered by Zimo-666 via static reverse engineering and dynamic end-to-end reproduction with core attribution. |
|---|
| Fonte | ⚠️ https://github.com/Zimo-666/DIR-878-cves/tree/main/03-settriggeradic-vlan-stack-overflow |
|---|
| Utente | ha ha-yang (UID 102151) |
|---|
| Sottomissione | 15/10/2026 09:45 (24 giorni fa) |
|---|
| Moderazione | 08/11/2026 15:47 (24 days later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 432893 [D-Link DIR-878 1.20B05 HNAP prog.cgi SetVLANSettings VID buffer overflow] |
|---|
| Punti | 20 |
|---|