| 제목 | Linksys E5600 1.1.0.26 Buffer Overflow - Out-of-bounds Write (CWE-787) |
|---|
| 설명 | A buffer overflow was discovered in Linksys E5600 firmware v1.1.0.26. The multipart/form-data header parser of /cgi-bin/upload_fw.cgi (init_multipart) appends attacker-controlled header lines into a 1024-byte global buffer using unbounded strcat(). A Content-Disposition line that does not contain "filename=" triggers a triple strcat of up to ~1533 bytes, and the parsing loop can be re-entered arbitrarily many times, making the overflow length attacker-controlled. The overflow was dynamically verified to crash the CGI process: a multipart POST with three crafted header blocks reliably produces HTTP 500 (process death by memory corruption) while the web server itself stays alive; a smaller overflow completes normally, confirming the vulnerable path executes. The endpoint is normally session-gated but becomes reachable without credentials via the pre-authentication session-issuance flaws in al.cgi / mesh_login.cgi. Proposed CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (6.5). Discovered by Zimo-666 via static reverse engineering and dynamic crash reproduction. |
|---|
| 원천 | ⚠️ https://github.com/Zimo-666/E5600-cves/tree/main/04-upload-fw-multipart-overflow |
|---|
| 사용자 | liuyingqi (UID 102046) |
|---|
| 제출 | 2026. 10. 10. PM 04:52 (27 날 ago) |
|---|
| 모더레이션 | 2026. 11. 03. PM 05:40 (24 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 430465 [Linksys E5600 1.1.0.26 Header Parser /cgi-bin/upload_fw.cgi init_multipart 메모리 손상] |
|---|
| 포인트들 | 20 |
|---|