Overview

D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the AccountPassword parameter in the SetSysEmailSettings module.

屏幕截图 2025-01-20 095036.png

Vulnerability details

The vulnerability is in the SetSysEmailSettings module of prog.cgi.

屏幕截图 2025-01-20 203205.png

The value of the HTTP request field “AccountPassword ” is passed to be the parameter a2 of the decrypt_aes. In decrypt_aes, this value and a stack space v6 are passed to sub_4270F4.

image.png

In sub_4270F4, there is a loop copying above a2 to the space of above v6. The lack of copying length limitation can lead to a buffer overflow.

image.png

Attack

屏幕截图 2025-01-20 234815.png

屏幕截图 2025-01-20 234932.png

屏幕截图 2025-01-20 235010.png

屏幕截图 2025-01-20 235036.png