| Title | TOTOLINK NR1800X V9.1.0u.6681_B20230703 Stack-based Buffer Overflow |
|---|
| Description | Because a physical device was not available, the target binary was patched to facilitate vulnerability analysis. On a real device, triggering the stack-based buffer overflow requires successful authentication via a valid session cookie. The vulnerable endpoint normally expects a request with parameters similar to:
{"topicurl":"setTracerouteCfg","command":"payload","num":"1"}
For analysis purposes, the authentication check associated with the setTracerouteCfg handler was removed (stripped) from the patched binary, allowing the vulnerable code path to be reached directly.
Since lighttpd does not support the required subprocess debugging mode in the emulation environment, the request handling environment was manually simulated and the binary was launched under gdb.
Finally, a crafted command parameter was supplied to trigger the stack-based buffer overflow and verify the vulnerability. |
|---|
| Source | ⚠️ https://github.com/lxiansheng488-bit/-/blob/main/TOTOlink/totallink%20%20setTracerouteCfg%20%20Stack%20Overflow%20.pdf |
|---|
| User | Anonymous User |
|---|
| Submission | 07/15/2026 04:53 (2 months ago) |
|---|
| Moderation | 08/29/2026 19:51 (2 months later) |
|---|
| Status | Duplicate |
|---|
| VulDB entry | 210225 [TOTOLINK NR1800X 9.1.0u.6279_B20210910 setTracerouteCfg command stack-based overflow] |
|---|
| Points | 0 |
|---|