| Titolo | D-Link DIR-878 1.20B05 Stack-based Buffer Overflow |
|---|
| Descrizione | A stack-based buffer overflow vulnerability was discovered in D-Link DIR-878 (REV A) firmware v1.20B05. In the SetWanSettings HNAP handler (default WANID = wan0), the Static branch helper (0x462aa0) and the DHCP branch helper (0x46342c) concatenate the user-controlled ConfigDNS/Primary and ConfigDNS/Secondary fields into a 64-byte stack buffer via sprintf plus strcat, before any IP-format validation. A Primary of about 164 bytes overwrites the saved return address. The handler is reachable pre-authentication via the previously disclosed HNAP authentication bypass (CVE-2020-15633 class), verified on v1.20B05. Reproduction: POST /HNAP1/?GetCAPTCHAsetting with SOAPAction SetWanSettings, Type=Static and Primary=200 x "A" returns HTTP 500 with SIGSEGV and a core dump; gdb forensics show the crash inside uClibc strcat with registers saturated by attacker bytes (a1, t1-t7 = 0x41414141). A short value returns OK. This wan0 instance is distinct from CVE-2026-90693 (wan3) and from the CVE-2022-4656x family (Password fields of SetWanSettings2/3). An unauthenticated adjacent-network attacker can crash the web management handler; return-address overwrite gives code-execution potential that was not further developed. Proposed CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (6.5). Discovered by Zimo-666 via static reverse engineering, dynamic differential testing and gdb register forensics. |
|---|
| Fonte | ⚠️ https://github.com/Zimo-666/DIR-878-cves/tree/main/02-setwansettings-dns-stack-overflow |
|---|
| Utente | ha ha-yang (UID 102151) |
|---|
| Sottomissione | 15/10/2026 09:47 (24 giorni fa) |
|---|
| Moderazione | 08/11/2026 15:47 (24 days later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 432894 [D-Link DIR-878 1.20B05 HNAP SetWanSettings ConfigDNS/Primary/ConfigDNS/Secondary buffer overflow] |
|---|
| Punti | 20 |
|---|