Wavlink AC3000 Buffer Overflow Vulnerability in adm.cgi set_sys_adm() Function

A buffer overflow vulnerability has been identified in the Wavlink AC3000 router, specifically in the adm.cgi set_sys_adm() function of version M33A8.V5030.210505. This vulnerability allows for a stack-based buffer overflow through a specially crafted HTTP request. An authenticated user can exploit this issue by sending the crafted request, leading to potential unauthorized code execution.

Impact

Exploitation of this vulnerability causes a stack-based buffer overflow, which can be leveraged to execute arbitrary code on the device.

Reproduction

To reproduce this vulnerability, an authenticated user must send an HTTP POST request to the adm.cgi binary with the 'page' parameter set to 'sysAdm'. The 'new_pwd' parameter must be crafted to exceed 0x118 bytes, which will overwrite the return address of the set_sys_adm() function, leading to a segmentation fault and indicating successful exploitation.