提出 #773579: D-Link DIR-513 1.10 Buffer Overflow

Stack-based Buffer Overflow in D-Link DIR-513 formSetDDNS function Description: D-Link DIR-513 devices (A1 FW110, A2 FW110) contain a stack-based buffer overflow vulnerability in the formSetDDNS function of the web management interface (at offset 0x466fdc). The vulnerability arises when the application processes the curTime parameter from an HTTP POST request. The program retrieves this user-controlled value via websGetVar and passes it to an unsafe sprintf call at address 0x467720 to format a string into a fixed-size 128-byte stack buffer (v31).

Due to the lack of boundary checks, an attacker can provide a specially crafted curTime value exceeding the buffer capacity to overwrite the return address on the stack (located 160 bytes away from the buffer start). This can lead to a Denial of Service (DoS) or arbitrary Remote Code Execution (RCE) with elevated privileges. Additionally, a secondary risk exists at address 0x4676e4, where a strcpy operation can further propagate the overflow into the err_msg global buffer.

• ソース: ⚠️ https://github.com/InfiniteLin/Lin-s-CVEdb/blob/main/DIR-513/formSetDDNS
• ユーザー: AttackingLin (UID 88138)
• 送信: 2026年03月06日 04:56 (7 月 ago)
• モデレーション: 2026年03月20日 09:27 (14 days later)
• ステータス: 重複
• VulDBエントリ: 349229 [D-Link DIR-513 1.10 /goform/formSetDDNS curTime メモリ破損]
• ポイント: 0