| 标题 | Wavlink WAVLINK_WN535M1-M35M1_V250922 V250922 Buffer Overflow |
|---|
| 描述 | A stack-based buffer overflow vulnerability has been identified in WAVLINK WN535M1/M35M1 router firmware version V250922. The vulnerability exists in the CGI binary /etc/lighttpd/www/cgi-bin/export_pingortrace.cgi. The program reads the HTTP Cookie header via getenv("HTTP_COOKIE") and copies the entire value into a fixed-size 256-byte stack buffer using strcpy() without any length validation.
The strcpy() call occurs BEFORE the authentication check (token validation via ipc_send to the ioos backend), making this a pre-authentication vulnerability. No credentials are required to trigger the overflow.
By sending an HTTP GET request to /cgi-bin/export_pingortrace.cgi with a Cookie header exceeding 304 bytes, an attacker can overwrite saved registers on the MIPS stack including $s0, $s1, $s2 and the return address $ra. This allows full control of program execution flow.
Exploitation has been verified using a ret2libc technique combined with a ROP gadget in musl libc. The attacker overwrites $s1 with the address of system() and $ra with a gadget that calls system() with an attacker-controlled command string placed on the stack. This achieves unauthenticated remote code execution. |
|---|
| 来源 | ⚠️ https://github.com/wcndsb-sketch/WAVLINK_WN535M1-M35M1_V250922-Buffer-Overflow/blob/main/CVE-Report-WAVLINK-WN535M1-RCE.pdf |
|---|
| 用户 | world5 (UID 99432) |
|---|
| 提交 | 2026-07-01 05時57分 (2 月前) |
|---|
| 管理 | 2026-08-17 06時49分 (2 months later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 391205 [Wavlink WN531P3/WN535M1 V250922 Export Pingortrace CGI export_pingortrace.cgi strcpy HTTP_COOKIE 内存损坏] |
|---|
| 积分 | 20 |
|---|