Invia #1035619: D-Link DIR-878 1.20B05 Stack-based Buffer Overflow

A stack-based buffer overflow vulnerability was discovered in D-Link DIR-878 (REV A) firmware v1.20B05. In the SetWanSettings HNAP handler (default WANID = wan0), the L2TP and PPTP branch helper (0x464134) copies the user-controlled ConfigDNS/Primary and ConfigDNS/Secondary fields into a 72-byte stack buffer via strncat(buf, src, strlen(src)), equivalent to an unbounded strcat, with no validation at any point. Disassembly confirms the saved return address at buffer offset 72; a Primary of 100 bytes crashes the process in both the L2TP and PPTP branches. The handler is reachable pre-authentication via the previously disclosed HNAP bypass (CVE-2020-15633 class), verified on v1.20B05. Reproduction: POST /HNAP1/?GetCAPTCHAsetting with SOAPAction SetWanSettings, Type=L2TP and Primary=100 x "A" returns HTTP 500 with FastCGI worker death and a core dump; two independent gdb captures show attacker bytes entering pointer-level dereferences (strlen called on 0x41414141 and on bytes of the Secondary value). A short Primary returns OK. This instance is distinct from the Static/DHCP branch helpers, from CVE-2026-90693 (wan3), and from the CVE-2022-4656x family (Password fields). An unauthenticated adjacent-network attacker can crash the web management handler; the return-address overwrite gives code-execution potential that was not further developed. Proposed CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (6.5). Discovered by Zimo-666 via static reverse engineering, disassembly frame analysis and two gdb register captures.

• Fonte: ⚠️ https://github.com/Zimo-666/DIR-878-cves/tree/main/05-setwansettings-l2tp-pptp-dns-overflow
• Utente: ha ha-yang (UID 102151)
• Sottomissione: 15/10/2026 09:48 (24 giorni fa)
• Moderazione: 08/11/2026 15:47 (24 days later)
• Stato: Accettato
• Voce VulDB: 432895 [D-Link DIR-878 1.20B05 HNAP SetWanSettings Primary/Secondary buffer overflow]
• Punti: 20