| 标题 | Wavlink NU516U1 V240425 Stack-based Buffer Overflow |
|---|
| 描述 | # Stack Buffer Overflow Vulnerability in Wavlink NU516U1 (V240425) login.cgi via "ipaddr" Parameter in sub_401A0C
#### Overview
- **Vendor:** Wavlink
- **Product:** NU516U1
- **Version:** WAVLINK-NU516U1-WO-A-2024-04-25-b516aec-GDBYFM (V240425)
- **Type:** Stack Buffer Overflow
- **Product Purpose:** USB Printer Server / Wireless Router
- **Firmware Download:**https://docs.wavlink.xyz/Firmware/?category=USB+Printer+Server&model=WL-NU516U1-A
- **Default Login Password:** admin
#### Basic Vulnerability Information
- **Vulnerable Function:** `sub_401A0C` (Handles the `sys_login1` interface)
- **Vulnerable Point:** `sprintf(v15, "web 2860 sys addUser \"%s\"", v4);`
- **Trigger Parameter:** `ipaddr` (Corresponds to `v4` in the code)
- **Prerequisites:** The submitted `password` parameter must match the MD5 hash of the administrator password.
#### Vulnerability Description
In the Wavlink NU516U1 firmware (version V240425), the `sub_401A0C` function within the `/cgi-bin/login.cgi` component contains a stack buffer overflow vulnerability. This function is primarily responsible for handling requests to the `sys_login1` page.
Internally, the function defines a fixed-size buffer `v15` of 128 bytes on the stack. After successfully verifying the MD5 hash of the password, the program uses the `sprintf` function to construct a system command, directly concatenating the user-supplied `ipaddr` parameter into this buffer. Since `sprintf` does not limit the length of the data written, and the program does not validate the length of the `ipaddr` input, an attacker can send an excessively long string (exceeding approximately 105 bytes).
When the oversized `ipaddr` data is written to `v15`, an out-of-bounds write occurs, overwriting adjacent local variables on the stack, Saved Registers, and the function's Return Address (`$ra`). This causes the CGI process to crash (Segmentation Fault), resulting in a Denial of Service (DoS). Under specific conditions, this could potentially be exploited to achieve Remote Code Execution (RCE). |
|---|
| 来源 | ⚠️ https://github.com/Wlz1112/WAVLINK-NU516-V240425/blob/main/ipaddr_Stack%20Buffer%20Overflow.md |
|---|
| 用户 | haimianbaobao (UID 94979) |
|---|
| 提交 | 2026-02-10 15時43分 (6 月前) |
|---|
| 管理 | 2026-03-05 19時21分 (23 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 349221 [Wavlink WL-NU516U1 V240425 /cgi-bin/login.cgi sub_401A0C ipaddr 内存损坏] |
|---|
| 积分 | 20 |
|---|