提出 #1043526: D-Link DIR-600L 2.17b02 Stack-based Buffer Overflow

A pre-authentication stack-based buffer overflow vulnerability was identified in D-Link DIR-600L hardware revision B, firmware 2.17b02.

The vulnerability exists in the HNAP handler hnap_main within the htdocs/cgibin executable.

The handler extracts an action name from the HTTP SOAPAction header and processes it using unbounded sprintf and strcpy operations targeting a fixed-size 256-byte stack buffer.

An excessively long attacker-controlled action name can overwrite adjacent stack memory. The supplied analysis indicates that the vulnerable handler can be reached without valid authentication because the SOAPAction whitelist validation does not adequately restrict the action suffix.

Static analysis identified the unsafe string operations. In a re-hosted QEMU-MIPSEL firmware environment, an unauthenticated HTTP request containing an oversized SOAPAction value triggered a segmentation fault in the CGI child process.

The captured host-side strace recorded:

SIGSEGV, SEGV_ACCERR, si_addr=0x45454545

Additional CPU-state records from separate tests show attacker-influenced register corruption.

The fault address 0x45454545 indicates an attacker-influenced invalid memory access but does not, by itself, establish program-counter control or prove arbitrary code execution.

The demonstrated impact is stack memory corruption and a CGI child-process crash. Exploitation on physical router hardware and reliable remote code execution have not been demonstrated.

Affected vendor: D-Link
Affected product: DIR-600L
Hardware revision: B
Affected firmware: 2.17b02
Affected component: hnap_main (htdocs/cgibin)
Vulnerability type: Stack-based Buffer Overflow
CWE: CWE-121
Attack vector: HTTP SOAPAction header
Authentication required: No, according to the supplied analysis
Testing environment: Re-hosted QEMU-MIPSEL

Related HNAP SOAPAction buffer overflow vulnerabilities have been documented in other D-Link products, including DIR-815 and DIR-645 (CVE-2021-43722). The relationship between these findings and the DIR-600L implementation requires root-cause comparison before determining whether a separate CVE is appropriate.

Vendor notification status: Not independently confirmed.

• ソース: ⚠️ https://github.com/ruanyi101/router-firmware-security-advisories/blob/main/router-firmware-GitHub-advisories/advisories/D-Link-DIR-600L-HNAP-SOAPAction.md
• ユーザー: ruanyi (UID 102203)
• 送信: 2026年10月19日 17:02 (26 日 ago)
• モデレーション: 2026年11月14日 07:38 (26 days later)
• ステータス: 承諾済み
• VulDBエントリ: 437417 [D-Link DIR-600L 2.17b02 HNAP htdocs/cgibin hnap_main メモリ破損]
• ポイント: 20