TOTOLINK A3300R Stack-Based Buffer Overflow Vulnerability in POST Parameter Handler

A stack-based buffer overflow vulnerability has been identified in the TOTOLINK A3300R router, specifically in the firmware version 17.0.0cu.557_B20221024. The vulnerability arises in the 'setOpModeCfg' function within the '/cgi-bin/cstecgi.cg' file, where the 'opmode' POST parameter is processed. The function writes the parameter value to 'opmode_custom' without proper length or content validation, allowing for excessive data to overflow the stack.

Impact

Exploitation of this vulnerability leads to a stack-based buffer overflow, which can commonly result in arbitrary code execution or causing the device to crash.

Reproduction

To reproduce this vulnerability, send a POST request to the '/cgi-bin/cstecgi.cg' endpoint with the 'opmode' parameter. The value of this parameter should be a payload designed to overflow the buffer, such as a string of repeated characters. The response can be checked to confirm the successful exploitation of the vulnerability.