Invia #983540: H3C Magic NX15 NX15V100R017 Denial of Service

A vulnerability was found in H3C Magic NX15 NX15V100R017. The affected element is the function sub_416874 of the file /usr/bin/usrlist. The manipulation of the file /var/run/agentlist leads to a stack-based buffer overflow, resulting in a denial of service. It is possible to initiate the attack remotely. An authentication is required to exploit this vulnerability. The exploit has been disclosed to the public and may be used.

Technical detail:
sub_416874 accumulates every line read from /var/run/agentlist into a 1024-byte stack buffer with strcat (offset 0x416C28), plus two additional bytes per line, without any bounds check. The binary is compiled without stack protection (__stack_chk_fail is not imported) and without _FORTIFY_SOURCE, which was confirmed by comparison with every other H3C binary in the firmware. Because the file is read from a 1-second timer callback and the process is respawned by procd, the overflow produces a persistent crash-restart loop; the kernel logged invalid write access faults with ra=0x416c30 inside /usr/bin/usrlist. Control-flow hijacking is NOT achievable and is not claimed: the accumulation buffer at $fp+0x30 grows into the source buffer of strcat at $fp+0x530, which is zeroed by memset on every iteration, so the saved return address at $fp+0x944 cannot be reached before the function dies inside libc; the reachable ceiling is 2304 bytes against a return address at 2324. The issue is therefore scored as denial of service only.

CWE: CWE-121 (Stack-based Buffer Overflow).
CVSS 3.1: AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H (4.9).

• Fonte: ⚠️ https://github.com/XxingGoD/H3C-NX15-R017-Vulns/tree/main/H3C/NX15R017/usrlist_stack_overflow_dos
• Utente: starlight (UID 101288)
• Sottomissione: 16/09/2026 09:48 (1 mese fa)
• Moderazione: 19/10/2026 17:59 (1 month later)
• Stato: Accettato
• Voce VulDB: 422421 [H3C Magic NX15 NX15V100R017 /usr/bin/usrlist sub_416874 buffer overflow]
• Punti: 20