| タイトル | TOTOLINK A720R V4.1.5cu.630_B20250509 Buffer Overflow |
|---|
| 説明 | A vulnerability has been identified in TOTOLINK A720R firmware V4.1.5cu.630_B20250509 within the MAC filtering functionality of the cstecgi.cgi binary. Insufficient bounds checking when processing the desc HTTP request parameter results in a stack-based buffer overflow due to the unsafe use of strcpy() on attacker-controlled input.
The vulnerable code copies the user-supplied value of the desc parameter into a fixed-size stack buffer without validating its length, allowing an authenticated attacker to overwrite the saved return address and corrupt the execution flow of the process. Because the binary is compiled without stack canaries and without PIE, the overflow can be reliably exploited to redirect execution to existing code located at fixed addresses within the binary.
An authenticated attacker with access to the management interface can trigger the vulnerability by sending a specially crafted request to the setMacFilterRules handler containing an overly long desc parameter. Successful exploitation allows the attacker to hijack the control flow of the cstecgi.cgi process and execute existing code paths within the binary, including routines capable of altering the device's behavior. This may result in the compromise of the confidentiality, integrity, and availability of the affected device. |
|---|
| ソース | ⚠️ https://github.com/Xernary/a720r-bof |
|---|
| ユーザー | Xernary (UID 91325) |
|---|
| 送信 | 2026年07月14日 12:50 (2 月 ago) |
|---|
| モデレーション | 2026年08月29日 19:40 (2 months later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 397055 [TOTOLINK A720R 4.1.5cu.630_B20250509 MAC Filtering cstecgi.cgi setMacFilterRules desc メモリ破損] |
|---|
| ポイント | 20 |
|---|