| 제목 | D-Link DIR-868L B1 Stack-based Buffer Overflow |
|---|
| 설명 | An unauthenticated stack-based buffer overflow exists in the cgibin binary of D-Link DIR-868L (hardware revision B1) firmware v2.01b05 (DIR868LB1_FW201b05.bin, component SHA-256: d09c8d79cbe2e896e78a82adfcc3fab15f804a8ee551524fe148223071392a55).
CVSS 3.1: 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
The authentication handler (file offset 0x14760, dispatched for authentication.cgi, authentication_logout.cgi, webfa_authentication.cgi, webfa_authentication_logout.cgi, and the SharePort WAN-side alias /dws/api/Login on port 8181) copies the URL query parameters "id" and "password" into fixed 0x400-byte stack buffers using strcpy() at function entry, before any authentication or input validation. The query-string parser imposes no length limit on parameter values.
A single unauthenticated HTTP GET request with an oversized "id" value overwrites the saved return address at offset 0x744 (password: 0xB44). No stack canary, executable stack (PT_GNU_STACK=RWX). Verified arbitrary command execution as root (Uid:0, CapEff:ffffffffffffffff) with a single request, independent of kernel ASLR modes 0/1.
Distinct from CVE-2016-5681 (VU#332115): that flaw overflows the session-cookie uid value in the cookie-validation function; this flaw overflows via id/password URL query parameters at the authentication dispatcher's entry copies (different taint source, vulnerable function, and overwrite offsets).
Full advisory and crash PoC: https://github.com/Walnut1337/CVE
Related (differentiated): https://www.kb.cert.org/vuls/id/332115 |
|---|
| 원천 | ⚠️ https://github.com/Walnut1337/CVE/blob/main/poc/poc_crash.py |
|---|
| 사용자 | Walnut1337 (UID 100856) |
|---|
| 제출 | 2026. 08. 28. PM 03:27 (23 날 ago) |
|---|
| 모더레이션 | 2026. 09. 20. AM 10:02 (23 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 408017 [D-Link DIR-868L 2.01b05 Authentication webfa_authentication.cgi strcpy id/password 메모리 손상] |
|---|
| 포인트들 | 20 |
|---|