| 제목 | Wavlink WAVLINK_WN535M1-M35M1_V250922 V250922 Buffer Overflow |
|---|
| 설명 | A stack-based buffer overflow vulnerability has been identified in WAVLINK WN535M1/M35M1 router firmware version V250922. The vulnerability exists in the CGI binary /etc/lighttpd/www/cgi-bin/export_pingortrace.cgi. The program reads the HTTP Cookie header via getenv("HTTP_COOKIE") and copies the entire value into a fixed-size 256-byte stack buffer using strcpy() without any length validation.
The strcpy() call occurs BEFORE the authentication check (token validation via ipc_send to the ioos backend), making this a pre-authentication vulnerability. No credentials are required to trigger the overflow.
By sending an HTTP GET request to /cgi-bin/export_pingortrace.cgi with a Cookie header exceeding 304 bytes, an attacker can overwrite saved registers on the MIPS stack including $s0, $s1, $s2 and the return address $ra. This allows full control of program execution flow.
Exploitation has been verified using a ret2libc technique combined with a ROP gadget in musl libc. The attacker overwrites $s1 with the address of system() and $ra with a gadget that calls system() with an attacker-controlled command string placed on the stack. This achieves unauthenticated remote code execution. |
|---|
| 원천 | ⚠️ https://github.com/wcndsb-sketch/WAVLINK_WN535M1-M35M1_V250922-Buffer-Overflow/blob/main/CVE-Report-WAVLINK-WN535M1-RCE.pdf |
|---|
| 사용자 | world5 (UID 99432) |
|---|
| 제출 | 2026. 07. 01. AM 05:57 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 08. 17. AM 06:49 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 391205 [Wavlink WN531P3/WN535M1 V250922 Export Pingortrace CGI export_pingortrace.cgi strcpy HTTP_COOKIE 메모리 손상] |
|---|
| 포인트들 | 20 |
|---|