제출 #932318: D-Link DI-8400 16.07 Buffer Overflow

D-Link DI-8400 is a full gigabit enterprise internet behavior management router manufactured by D-Link (Shanghai) Electronics Equipment Co., Ltd, supporting concurrent access for up to 360 corporate network terminals. A stack-based buffer overflow vulnerability resides in the menu_nat_more_asp CGI function at memory address 0x42417c of the device’s web administration service, which processes HTTP POST requests submitted to the /menu_nat_more.asp endpoint for advanced NAT rule configuration.
The function retrieves ten fully user-controllable HTTP request parameters via the httpd_get_parm interface without implementing any pre-transmission length validation. Execution enters dangerous vulnerable code branches only when the opt parameter is set to "add" or "mod". Within this branch, the program invokes the unsafe unbounded sprintf routine to concatenate all ten user-supplied parameters, separated by fixed pipe and angle bracket delimiters, into a 10240-byte stack buffer named v31. The combined formatted string exceeds the safe capacity of 10229 bytes once the aggregated input length grows too large, leading to an out-of-bounds stack write. Additionally, the code loads existing NAT rules from NVRAM into a second 10240-byte stack buffer v32 and uses unbounded strcat to append the newly formatted rule string, creating a secondary overflow risk from cumulative data accumulation after repeated add operations.
Reverse engineering of the stack frame layout confirms the offset from the start of buffer v31 to the stack’s saved function return address is 20604 bytes. The embedded web server enforces a global maximum HTTP request payload limit of 102400 bytes, which is sufficiently large to transmit the malicious payload required to overwrite critical stack metadata including local variables, saved general-purpose registers, frame pointers, and the return address. An authenticated remote attacker holding valid administrative session cookies can construct extremely long parameter payloads to hijack program execution flow. Successful exploitation allows full arbitrary native code execution on the router hardware, complete device administrative compromise, leakage of sensitive internal network configurations and credentials, persistent denial-of-service outages, and lateral movement to compromise other hosts connected to the local area network.

• 원천: ⚠️ https://github.com/Vivi-Xray/Xray-s-cve-/tree/main/menu_nat_more_asp
• 사용자: Xray (UID 100597)
• 제출: 2026. 08. 16. AM 07:37 (1 월 ago)
• 모더레이션: 2026. 09. 27. PM 08:20 (1 month later)
• 상태: 수락
• VulDB 항목: 410953 [D-Link DI-8400 16.07 Web Administration Service menu_nat_more.asp menu_nat_more_asp opt 메모리 손상]
• 포인트들: 20