| タイトル | D-Link DIR-868L B1 Stack-based Buffer Overflow |
|---|
| 説明 | An unauthenticated stack-based buffer overflow exists in the cgibin binary of D-Link DIR-868L (hardware revision B1) firmware v2.01b05 (DIR868LB1_FW201b05.bin, component SHA-256: d09c8d79cbe2e896e78a82adfcc3fab15f804a8ee551524fe148223071392a55).
CVSS 3.1: 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
The authentication handler (file offset 0x14760, dispatched for authentication.cgi, authentication_logout.cgi, webfa_authentication.cgi, webfa_authentication_logout.cgi, and the SharePort WAN-side alias /dws/api/Login on port 8181) copies the URL query parameters "id" and "password" into fixed 0x400-byte stack buffers using strcpy() at function entry, before any authentication or input validation. The query-string parser imposes no length limit on parameter values.
A single unauthenticated HTTP GET request with an oversized "id" value overwrites the saved return address at offset 0x744 (password: 0xB44). No stack canary, executable stack (PT_GNU_STACK=RWX). Verified arbitrary command execution as root (Uid:0, CapEff:ffffffffffffffff) with a single request, independent of kernel ASLR modes 0/1.
Distinct from CVE-2016-5681 (VU#332115): that flaw overflows the session-cookie uid value in the cookie-validation function; this flaw overflows via id/password URL query parameters at the authentication dispatcher's entry copies (different taint source, vulnerable function, and overwrite offsets).
Full advisory and crash PoC: https://github.com/Walnut1337/CVE
Related (differentiated): https://www.kb.cert.org/vuls/id/332115 |
|---|
| ソース | ⚠️ https://github.com/Walnut1337/CVE/blob/main/poc/poc_crash.py |
|---|
| ユーザー | Walnut1337 (UID 100856) |
|---|
| 送信 | 2026年08月28日 15:27 (23 日 ago) |
|---|
| モデレーション | 2026年09月20日 10:02 (23 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 408017 [D-Link DIR-868L 2.01b05 Authentication webfa_authentication.cgi strcpy id/password メモリ破損] |
|---|
| ポイント | 20 |
|---|