제출 #977223: TOTOLINK A3002MU V1.0.0-B20230403.1455 Stack-based Buffer Overflow

The IPv6 configuration handler of the TOTOLINK A3002MU contains five independent unbounded stack copies that share a single frame. The handler is entered by posting to /boafrm/formIpv6Setup, and each affected parameter is read through the generic getter sub_4101C8, which permits up to 4096 bytes and performs URL decoding without any length or character validation. The values are then copied with strcpy() into 64-byte stack buffers: static_ipv6 into the first, static_gw into the second, and static_dns1, dhcp_dns1 and pppoe_dns1 into the third, with the corresponding dns2 variants sharing the fourth. The buffers are laid out consecutively with a fixed stride of 64 bytes, so a single over-long parameter does not merely corrupt its own buffer but walks through the neighbouring ones and continues into the remainder of the frame. The frame is 664 bytes in total and the saved return address is stored at [sp+0x294], which places it 608 bytes above the first buffer, 544 bytes above the second, 480 bytes above the third and 416 bytes above the fourth. A parameter of 612 bytes supplied as static_ipv6 therefore reaches and replaces the saved return address, and any of the other parameters can do the same at its own offset. As with the sibling overflow in formFilter, the executable is a non-PIE MIPS32 little-endian binary loaded at a fixed base with no stack canary and with address-space layout randomisation disabled, so the overwrite is immediately useful for control-flow hijacking and can be extended into root code execution; at minimum it produces a reliable denial of service in which the web server dies and the management interface becomes unavailable until the watchdog restarts it. No credentials are required, because dispatch is unauthenticated as documented in A3002MU-AUTH-01. The multiple sinks are reported as one entry because they share a root cause, a frame and a fix, but each parameter is independently reachable.

• 원천: ⚠️ https://gist.github.com/H3rmesk1t/c5edc9a304b44d9550e36eba5d0130c4
• 사용자: H3rmesk1t (UID 70306)
• 제출: 2026. 09. 14. AM 11:00 (21 날 ago)
• 모더레이션: 2026. 10. 05. AM 12:18 (21 days later)
• 상태: 중복
• VulDB 항목: 403188 [Totolink A3002MU Hh-B20211125.1046 boa /boafrm/formIpv6Setup static_ipv6 메모리 손상]
• 포인트들: 0