| Название | D-Link DIR-513 1.10 Buffer Overflow |
|---|
| Описание | Stack-based Buffer Overflow in D-Link DIR-513 formSetDDNS function Description: D-Link DIR-513 devices (A1 FW110, A2 FW110) contain a stack-based buffer overflow vulnerability in the formSetDDNS function of the web management interface (at offset 0x466fdc). The vulnerability arises when the application processes the curTime parameter from an HTTP POST request. The program retrieves this user-controlled value via websGetVar and passes it to an unsafe sprintf call at address 0x467720 to format a string into a fixed-size 128-byte stack buffer (v31).
Due to the lack of boundary checks, an attacker can provide a specially crafted curTime value exceeding the buffer capacity to overwrite the return address on the stack (located 160 bytes away from the buffer start). This can lead to a Denial of Service (DoS) or arbitrary Remote Code Execution (RCE) with elevated privileges. Additionally, a secondary risk exists at address 0x4676e4, where a strcpy operation can further propagate the overflow into the err_msg global buffer. |
|---|
| Источник | ⚠️ https://github.com/InfiniteLin/Lin-s-CVEdb/blob/main/DIR-513/formSetDDNS |
|---|
| Пользователь | AttackingLin (UID 88138) |
|---|
| Представление | 06.03.2026 04:56 (7 месяцы назад) |
|---|
| Модерация | 20.03.2026 09:27 (14 days later) |
|---|
| Статус | Дубликат |
|---|
| Запись VulDB | 349229 [D-Link DIR-513 1.10 /goform/formSetDDNS curTime повреждение памяти] |
|---|
| Баллы | 0 |
|---|