| 标题 | Linksys E5600 1.1.0.26 Buffer Overflow - Out-of-bounds Write (CWE-787) |
|---|
| 描述 | Multiple global buffer overflows were discovered in Linksys E5600 firmware v1.1.0.26. The JSON request parser of /cgi-bin/mesh_login.cgi copies six attacker-controlled string fields into fixed-size global buffers using unbounded strcpy(): username (130 bytes), password (130 bytes), token (64 bytes), source (6 bytes), cn (16 bytes) and action (16 bytes). Any over-long JSON field overwrites adjacent global variables and subsequent .bss data, including security-relevant fields evaluated by the login routine and a saved copy of the request object pointer. The endpoint is reachable without authentication. Reproduction: POST a JSON body with a 2000-byte "source" value to /cgi-bin/mesh_login.cgi. In the tested rehosted environment the out-of-bounds write executes unconditionally (statically evident) while the corruption lands in slack .bss without an observed crash in the tested code path; impact on production devices depends on the exact .bss layout. Proposed CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N (3.5, conservative). Discovered by Zimo-666 via static reverse engineering and dynamic probing. |
|---|
| 来源 | ⚠️ https://github.com/Zimo-666/E5600-cves/tree/main/03-mesh-login-global-overflow |
|---|
| 用户 | liuyingqi (UID 102046) |
|---|
| 提交 | 2026-10-10 16時51分 (27 日前) |
|---|
| 管理 | 2026-11-03 17時40分 (24 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 430464 [Linksys E5600 1.1.0.26 JSON Request Parser /cgi-bin/mesh_login.cgi strcpy username/password/token/source/cn/action 内存损坏] |
|---|
| 积分 | 20 |
|---|