提出 #755033: Wavlink NU516U1 V240425 Stack-based Buffer Overflow

# **Stack Buffer Overflow Vulnerability in Wavlink NU516U1 (V240425) nas.cgi Component via "User1Passwd" Parameter in sub_4011E8 Function**

### Overview

- **Vendor:** Wavlink
- **Product:** NU516U1
- **Version:** WAVLINK-NU516U1-WO-A-2024-04-25-b516aec-GDBYFM
- **Type:** Stack Buffer Overflow
- **Usage:** USB Printer Server / Wireless Router
- **Firmware Download:** `https://docs.wavlink.xyz/Firmware/?category=USB+Printer+Server&model=WL-NU516U1-A`
- **Default Password:** admin

### Basic Vulnerability Information

- **Vulnerable Binary:** `/cgi-bin/nas.cgi`
- **Vulnerable Function:** `sub_4011E8` (Main handler for NAS settings) and its called helper function `sub_405050` (String escape processing).
- **Vulnerability Point:** String concatenation logic inside the helper function `sub_405050` (similar to `strcat` or `sprintf` appending).
- **Trigger Parameter:** `User1Passwd` (Corresponds to `v2` -> `v3` in the code).
- **Prerequisites:**
- The attacker possesses a valid Login Session (Cookie).
- The request parameter includes `page=nas`.

### Vulnerability Description

When handling NAS (Storage Management) setting requests, the `sub_4011E8` function in `nas.cgi` is responsible for parsing user requests. This function retrieves the user-submitted POST parameter `User1Passwd` via `sub_403708` and copies it to heap memory `v3`.

Subsequently, `v3` is passed to the helper function `sub_405050` with the intention of storing the processed (usually escaping special characters) string into a fixed-size buffer `v6` allocated on the stack. According to code analysis, the size of `v6` is confirmed to be **128 bytes** via `memset(v6, 0, 128)`.

The helper function `sub_405050` exhibits a "character expansion" effect when processing the input string (e.g., adding an escape character `\` before a character, causing the length to double). Since this function lacks boundary checks for the target buffer size when writing data to `v6`, an attacker only needs to provide a `User1Passwd` exceeding a certain threshold (approximately 64 bytes or more); the data length after expansion will exceed 128 bytes, thereby overflowing the `v6` buffer.

The overflowed data will overwrite other local variables on the stack and eventually overwrite the function's return address (`$ra`). When the `sub_4011E8` function finishes execution and prepares to return, the program will jump to the address tampered with by the attacker, resulting in Remote Code Execution (RCE) or Denial of Service (DoS).

• ユーザー: haimianbaobao (UID 94979)
• 送信: 2026年02月10日 03:49 (8 月 ago)
• モデレーション: 2026年03月05日 19:20 (24 days later)
• ステータス: 重複
• VulDBエントリ: 346174 [Wavlink WL-NU516U1 20251208 /cgi-bin/nas.cgi sub_401218 User1Passwd メモリ破損]
• ポイント: 0