| 제목 | DELTA WPLSoft software heap overflow vulnerability |
|---|
| 설명 | Use man-in-the-middle attack methods to hijack the data flow between WPLSoft software and PLC equipment.
Distort the data packets replied by the PLC device and send them to the WPLSoft software.
This causes a heap overflow vulnerability in the WPLSoft software and causes the software to crash.
1. Use a man-in-the-middle hijacking script to hijack and forward data flows.
2. Set the WPLSoft software to specify the proxy IP.
3. When the software is normally operated to upload the PLC device program, and then it is found that the length of the modbus data packet is inconsistent with the length field, it will cause the software to crash.
4. Locate the recv position, track the data flow in the memory, and find that the source code memcpy modbus data to the heap, and the length is the length field in modbus.
5. Further debugging revealed that the cause of the WPLSoft software crash was that when the value of the length field was large enough, the memcpy process would copy the data in the memory to the .rdata read-only data segment, causing the program to abnormally crash and exit. |
|---|
| 원천 | ⚠️ https://drive.google.com/drive/folders/1oYxs_KxK4Ftd7OsexGk6upkxhJ3-m8M3?usp=drive_link |
|---|
| 사용자 | Anonymous User |
|---|
| 제출 | 2023. 09. 21. PM 02:13 (3 연령 ago) |
|---|
| 모더레이션 | 2023. 10. 09. PM 03:46 (18 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 241583 [Delta Electronics WPLSoft 까지 2.51 Modbus Data Packet 메모리 손상] |
|---|
| 포인트들 | 20 |
|---|