UTT 进取 520W Buffer Overflow Vulnerability in formArpBindConfig

A buffer overflow vulnerability has been identified in the UTT 进取 520W router, specifically in the firmware version through v3v1.7.7-180627. The issue arises in the formArpBindConfig endpoint, where the strcpy function is used to copy data from the pools parameter without proper bounds checking. This flaw can be exploited remotely, leading to a denial-of-service condition.

Impact

Exploitation of this vulnerability causes a buffer overflow, which can be used to execute arbitrary code or cause a denial-of-service condition.

Reproduction

The vulnerability can be reproduced by sending a POST request to the /goform/formArpBindConfig endpoint. The request must include a 'pools' parameter with a payload that exceeds the buffer size, effectively causing a buffer overflow. This can be done by manipulating the Content-Length header to accommodate the oversized payload.