Mercury KM08-708H GiGA WiFi Wave2 Buffer Overflow Vulnerability in System Administration Function

A buffer overflow vulnerability has been identified in the Mercury KM08-708H GiGA WiFi Wave2 version 1.1. The issue arises in the function sub_450B2C within the file /goform/mcr_setSysAdm. The vulnerability is triggered by manipulating the ChgUserId argument, leading to a buffer overflow. This flaw can be exploited remotely, and a public exploit is available.

Impact

Exploitation of this vulnerability causes a buffer overflow, which can lead to arbitrary code execution or a denial-of-service condition.

Reproduction

The vulnerability can be reproduced by sending a crafted request to the /goform/mcr_setSysAdm endpoint, including a ChgUserId argument that exceeds the buffer size. The sub_450B2C function will then copy the input without proper length validation, causing a buffer overflow.