UTT 1250GW Buffer Overflow Vulnerability in Channel Change Function

A buffer overflow vulnerability has been identified in the UTT Jinqi 1250GW router, affecting firmware versions through v2v3.2.2-200710. The vulnerability arises in the '/goform/aspChangeChannel' function, where the 'pvid' parameter can be manipulated, leading to a buffer overflow. This issue can be exploited remotely, and a public exploit is available.

Impact

Exploitation of this vulnerability causes a buffer overflow, which can lead to arbitrary code execution or a denial-of-service condition on the device.

Reproduction

The vulnerability can be reproduced by sending a POST request to the '/goform/aspChangeChannel' endpoint. The request must include a 'pvid' parameter with a value that exceeds the buffer size, effectively causing the buffer overflow. This can be done by using the 'setApVlanId' value, which bypasses the initial validation and triggers the overflow when processed by the 'strcpy' function.