Submit #1022557: TOTOLINK A950RG V4.1.2cu.5268_B20221104 Stack Buffer Overflow

infostat.cgi is the device-information CGI of the TOTOLINK A950RG. It is a standalone MIPS32 executable under /web_cste/cgi-bin/, it is mapped as a CGI program by lighttpd through cgi.assign = ("" => ""), and it contains no reference to the cste session token, no call to the authentication gate in cstecgi.cgi and no access check of any kind, so any client that can reach TCP port 80 can invoke it. The program reads its request body with a length that it takes directly from the environment: main calls strtol(getenv("CONTENT_LENGTH"), 0, 10), adds one and passes the result straight to fread as the element count, with a 4096-byte stack array as the destination. There is no comparison against sizeof the destination and no upper bound of any kind on the value, so a request whose Content-Length exceeds 4096 bytes writes past the end of v11 into the rest of the frame. v11 is immediately followed by a second 4100-byte buffer and then by the saved registers, and the frame is 8272 bytes in total, so the copy can reach the saved return address of main at an offset of 8200 bytes from the start of v11. The overflow does not stop there. The body is then handed to sub_402340, which performs strcpy(v9, a1) into a 5120-byte stack buffer as the first step of its XOR decoder, again with no length check; that second buffer sits 5152 bytes below its own saved return address, so the same request overwrites a second return address in a second frame. A request of 5156 bytes is therefore the shortest body that produces a controlled control-flow corruption: 5152 bytes of filler followed by one four-byte word that replaces the return address of sub_402340. The target binary is non-PIE and loaded at a fixed base, it is compiled without stack canaries, and the vendor firmware does not enable address-space layout randomisation, so the addresses of the binary, of the loaded uClibc and of the stack are stable across reboots and can be hard-coded in a payload; with the 30 KB request allowance there is ample room past the saved return address for a return-oriented chain or for a system() call with an attacker-supplied argument. At minimum the primitive yields a reliable denial of service, because a body of 5156 bytes or more always destroys the return address of a frame that the CGI must restore. The handler is reachable without credentials, without a session token and without any interaction from the administrator.

• Source: ⚠️ https://gist.github.com/H3rmesk1t/ad72def4ccc232757d4cbabf45da72cb
• User: LiuYijun_JX.SGCC (UID 102035)
• Submission: 10/10/2026 04:03 (21 days ago)
• Moderation: 10/26/2026 14:14 (16 days later)
• Status: Accepted
• VulDB entry: 426406 [TOTOLINK A950RG 4.1.2cu.5268_B20221104 Device-Information CGI infostat.cgi sub_402340 CONTENT_LENGTH stack-based overflow]
• Points: 20