Linksys E8450 Buffer Overflow Vulnerability in DHCP Start IP Parsing

A buffer overflow vulnerability has been identified in the Linksys E8450 router, specifically in version 1.2.00.360516. The issue arises in the JSON parsing function 'sub_422eb8', where the 'dhcpstart_ip' field is copied to the stack using 'strcpy' without proper length validation. This lack of verification creates an opportunity for a buffer overflow, potentially allowing for arbitrary code execution or causing the device to crash.

Impact

Exploitation of this vulnerability leads to a buffer overflow, which can commonly result in arbitrary code execution or causing the device to crash.

Reproduction

The vulnerability can be reproduced by sending a crafted JSON payload to the 'http://target/cgi-bin/portal.cgi' URL. The payload must include the 'dhcpstart_ip' field with a value that exceeds the expected length, which will trigger the buffer overflow by overwriting adjacent memory on the stack.