Overview

D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the Password parameter in the SetDynamicDNSSettings module.

屏幕截图 2025-01-20 095036.png

Vulnerability details

The vulnerability is in the SetDynamicDNSSettings module of prog.cgi.

屏幕截图 2025-01-20 203205.png

The value of the HTTP request field “Password ” is passed to be the parameter a2 of the decrypt_aes. In decrypt_aes, this value and a stack space v6 are passed to sub_4270F4.

image.png

In sub_4270F4, there is a loop copying above a2 to the space of above v6. The lack of copying length limitation can lead to a buffer overflow.

image.png

Attack

屏幕截图 2025-01-21 001751.png

屏幕截图 2025-01-21 001820.png

屏幕截图 2025-01-21 001900.png

屏幕截图 2025-01-21 001931.png