| 标题 | Edimax BR-6428nC v1.16 Stack-based Buffer Overflow |
|---|
| 描述 | Vulnerability Title: Stack-Based Buffer Overflow in formWizSurvey via interface1 and interface2 Parameters on Edimax BR-6428nC
Discovered by: tzh00203
Contact Information: [email protected]
Affected Version: Edimax BR-6428nC firmware based on the provided GPL source package (the exact public firmware version string should be confirmed on the test image before submission)
Component: boa wireless wizard handler formWizSurvey
1. Vulnerability Overview
A stack-based buffer overflow vulnerability exists in the wireless survey wizard handler formWizSurvey of Edimax BR-6428nC. The handler copies attacker-controlled request parameters interface1 and interface2 into fixed-size stack buffers using strcpy() with no length checks.
2. Detailed Description
The vulnerable function contains the following local buffers:
char tmpBuf[100], tmpBuf1[100], tmpBuf2[100], tmpBuf3[100], interface[2][200];
When the refresh branch is taken, the code copies request parameters directly:
strcpy(interface[0], websGetVar(wp, T("interface1"), T("")));
strcpy(interface[1], websGetVar(wp, T("interface2"), T("")));
No length validation is performed. Any attacker-controlled string longer than 199 bytes can overflow the corresponding interface entry and corrupt the stack.
Impact
Crash of the management process
Denial of service
Possible code execution depending on exploitability
3. Affected Versions
This issue affects Edimax BR-6428nC firmware builds containing the vulnerable formWizSurvey() implementation from the provided GPL source package.
The public firmware label should be confirmed on a test image before final submission.
4. Steps to Reproduce
Send a POST request to /goform/formWizSurvey.
Include refresh=1.
Provide an oversized interface1 or interface2 value.
Observe a crash or abnormal behavior.
5. PoC
Example request:
python3 - <<'PY' > /tmp/wizsurvey_post.txt
print("refresh=1&interface1=" + "A"*2000)
PY
curl -X POST "http://192.168.2.1/goform/formWizSurvey" \
--data-binary @/tmp/wizsurvey_post.txt
Expected Result
The router web interface crashes or becomes unstable after the request is processed.
6. Suggested Fix
To fix this vulnerability:
Replace unsafe strcpy() calls with bounded copies.
Enforce maximum lengths for wizard parameters before storing them in stack buffers.
Reject malformed interface1 and interface2 values early.
7. Contact Information
Vulnerability Reporter: tzh00203
Email: [email protected] |
|---|
| 来源 | ⚠️ https://tzh00203.notion.site/Edimax-BR-6428nC-formWizSurvey-Interface-Stack-Overflow-33db5c52018a80b5b950feb29846006c |
|---|
| 用户 | tian (UID 93438) |
|---|
| 提交 | 2026-07-27 12時04分 (3 月前) |
|---|
| 管理 | 2026-09-26 13時26分 (2 months later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 410616 [Edimax BR-6428nC 1.16 Wireless Wizard /goform/formWizSurvey interface1/interface2 内存损坏] |
|---|
| 积分 | 17 |
|---|