| 标题 | D-Link DIR-513 1.10 Buffer Overflow |
|---|
| 描述 | A critical stack-based buffer overflow vulnerability exists in the Web management interface of D-Link DIR-513 routers (A1 FW110, A2 FW110). The flaw is located within the formSetWAN_Wizard52 function at memory address 0x44a940.
The vulnerability is triggered when the application processes an HTTP POST request containing a specially crafted, overlong curTime parameter. The program retrieves this parameter via websGetVar and subsequently utilizes the unsafe sprintf function (at 0x44ac84) to format the input into a fixed-size stack buffer v30 (200 bytes) located at SP + 0xE0.
Because the function lacks any boundary or length validation for the curTime input, an attacker can provide a payload that overflows the buffer and overwrites the saved return address (RA) at SP + 0x1C8. This allows a remote attacker to hijack the program's control flow, leading to a Denial of Service (DoS) or arbitrary Remote Code Execution (RCE) with elevated privileges. |
|---|
| 来源 | ⚠️ https://github.com/InfiniteLin/Lin-s-CVEdb/tree/main/DIR-513/formSetWAN_Wizard52 |
|---|
| 用户 | AttackingLin (UID 88138) |
|---|
| 提交 | 2026-03-06 04時50分 (7 月前) |
|---|
| 管理 | 2026-03-20 09時27分 (14 days later) |
|---|
| 状态 | 重复 |
|---|
| VulDB条目 | 349838 [D-Link DIR-513 1.10 formSetWAN_Wizard52 curTime 内存损坏] |
|---|
| 积分 | 0 |
|---|