| Título | D-Link DIR-600L 2.17b02 Stack-based Buffer Overflow |
|---|
| Descrição | A pre-authentication stack-based buffer overflow vulnerability was identified in D-Link DIR-600L hardware revision B, firmware 2.17b02.
The vulnerability exists in the authentication.cgi login handler within the htdocs/cgibin executable.
The handler processes user-controlled id and password parameters using unbounded strcpy operations to copy these values into fixed-size stack buffers before authentication is completed.
An unauthenticated attacker with access to the router's web management interface can provide an excessively long login parameter, causing adjacent stack memory to be overwritten.
Static analysis of the firmware identified the unsafe string-copy operations in the authenticationcgi_main function.
In a re-hosted QEMU-MIPSEL environment, a crafted unauthenticated HTTP request containing an oversized id parameter caused the CGI child process to terminate with SIGSEGV.
The captured host-side strace recorded:
SIGSEGV, SEGV_ACCERR, si_addr=0x47474747
The attacker-influenced fault address is consistent with memory corruption. However, the si_addr value alone does not establish the exact program-counter register value or prove arbitrary code execution.
The demonstrated impact is memory corruption and a crash of the CGI child process. Code execution on physical router hardware has not been demonstrated.
Affected vendor: D-Link
Affected product: DIR-600L
Hardware revision: B
Affected firmware: 2.17b02
Affected component: authentication.cgi
Vulnerability type: Stack-based Buffer Overflow
CWE: CWE-121
Attack vector: HTTP login request
Authentication required: No
Testing environment: Re-hosted QEMU-MIPSEL
This vulnerability affects the login parameter handling code and requires separate assessment from previously reported login-related vulnerabilities in other D-Link firmware versions.
|
|---|
| Fonte | ⚠️ https://github.com/ruanyi101/router-firmware-security-advisories/blob/main/router-firmware-GitHub-advisories/advisories/D-Link-DIR-600L-authentication-cgi.md |
|---|
| Utilizador | ruanyi (UID 102203) |
|---|
| Submissão | 19/10/2026 16h58 (há 26 dias) |
|---|
| Moderação | 14/11/2026 07h38 (26 days later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 437416 [D-Link DIR-600L 2.17/2.17b02 authentication.cgi authenticationcgi_main id/password Excesso de tampão] |
|---|
| Pontos | 20 |
|---|