UTT Aggressive 520W Buffer Overflow Vulnerability in Web Host Filter

A buffer overflow vulnerability has been identified in the UTT Aggressive 520W router, specifically in the firmware version through 1.7.7-180627. The issue arises in the '/goform/websHostFilter' endpoint, where the 'strcpy' function is used to copy data from the 'addHostFilter' parameter without proper boundary checks. This vulnerability can be exploited remotely, leading to a denial-of-service condition.

Impact

Exploitation of this vulnerability causes a buffer overflow, which can be used to execute arbitrary code or cause a denial-of-service condition by crashing the device.

Reproduction

The vulnerability can be reproduced by sending a POST request to the '/goform/websHostFilter' endpoint. The request must include a 'Content-Type' of 'application/x-www-form-urlencoded' and an 'Authorization' header with a valid Digest authentication. The 'addHostFilter' parameter should be populated with a payload that exceeds the buffer size, triggering the overflow.