| Title | Wavlink WL-WN530BE1-A M30BE1_V251117 Stack-based Buffer Overflow |
|---|
| Description | CWE-121
- Finding: `wavlink-export-settings-cookie-strcpy-20260729`
## Summary
An unauthenticated attacker who can reach `http://127.0.0.1:80/cgi-bin/ExportAllSettings.cgi/cgi-bin/ExportAllSettings.cgi` can overflow a fixed stack buffer through `HTTP_COOKIE`. The recorded validated raw-HTTP matrix transports a C0-free ARM ROP in `Cookie`, carries the command in `X-Cmd`, and creates an independent same-firmware marker in the HTTP/1.1, HTTP/1.0, and lowercase-Cookie variants. HTTP 500 is an expected CGI termination result, not the success oracle.
## Reproduction
1. Inspect the exact construction: `python3 poc.py --show-layout`.
2. Replay the recorded HTTP request: `python3 poc.py`.
3. Read the authoritative details in `artifacts/http_rce_matrix.json` and `artifacts/payload_layout.txt`.
This package was re-rendered from the existing validated artifacts. The rendering pass does not claim a new live run; if the emulated service is unavailable, replay failure is an infrastructure result.
## Impact
Unauthenticated remote command execution on the emulated same-firmware HTTP path, with an independent marker oracle. The exact packed words, offsets, little-endian bytes, alignment checks, and forbidden-byte preflight are included in the report and payload-layout artifact |
|---|
| Source | ⚠️ https://gist.github.com/Rauzk/9ef4fe7574e5689386cc43139f4cf9e1 |
|---|
| User | Tarbely (UID 99399) |
|---|
| Submission | 07/30/2026 01:22 (3 months ago) |
|---|
| Moderation | 10/12/2026 10:33 (2 months later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 416860 [Wavlink WL-WN530BE1-A 251117 Settings Export CGI ExportAllSettings.cgi strcpy HTTP_COOKIE/X-Cmd stack-based overflow] |
|---|
| Points | 20 |
|---|