| 标题 | Linksys E5600 1.1.0.26 Buffer Overflow - Out-of-bounds Write (CWE-787) |
|---|
| 描述 | A buffer overflow was discovered in Linksys E5600 firmware v1.1.0.26. The multipart/form-data header parser of /cgi-bin/upload_fw.cgi (init_multipart) appends attacker-controlled header lines into a 1024-byte global buffer using unbounded strcat(). A Content-Disposition line that does not contain "filename=" triggers a triple strcat of up to ~1533 bytes, and the parsing loop can be re-entered arbitrarily many times, making the overflow length attacker-controlled. The overflow was dynamically verified to crash the CGI process: a multipart POST with three crafted header blocks reliably produces HTTP 500 (process death by memory corruption) while the web server itself stays alive; a smaller overflow completes normally, confirming the vulnerable path executes. The endpoint is normally session-gated but becomes reachable without credentials via the pre-authentication session-issuance flaws in al.cgi / mesh_login.cgi. Proposed CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (6.5). Discovered by Zimo-666 via static reverse engineering and dynamic crash reproduction. |
|---|
| 来源 | ⚠️ https://github.com/Zimo-666/E5600-cves/tree/main/04-upload-fw-multipart-overflow |
|---|
| 用户 | liuyingqi (UID 102046) |
|---|
| 提交 | 2026-10-10 16時52分 (27 日前) |
|---|
| 管理 | 2026-11-03 17時40分 (24 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 430465 [Linksys E5600 1.1.0.26 Header Parser /cgi-bin/upload_fw.cgi init_multipart 内存损坏] |
|---|
| 积分 | 20 |
|---|