D-Link DI-7100G C1 Buffer Overflow Vulnerability in jhttpd Web Component

A buffer overflow vulnerability has been identified in the D-Link DI-7100G C1 router, affecting firmware versions prior to 20250928. The issue arises in the jhttpd web component, specifically within the function sub_4BD4F8 of the file /webchat/hi_block.asp. The vulnerability can be exploited remotely by manipulating the popupId argument.

Impact

Exploitation of this vulnerability leads to a buffer overflow, which can commonly result in arbitrary code execution or causing the device to crash.

Reproduction

The vulnerability can be reproduced by sending a crafted request to the /webchat/hi_block.asp endpoint, including a popupId argument that exceeds the buffer size, causing a buffer overflow condition.