UTT 进取 512W Buffer Overflow Vulnerability in formPictureUrl Function

A buffer overflow vulnerability has been identified in the UTT 进取 512W router, specifically in versions through 1.7.7-171114. The issue arises in the formPictureUrl endpoint, where the strcpy function is used to copy the importPictureURL parameter without proper boundary checks. This vulnerability can be exploited remotely, leading to potential buffer overflow attacks and denial-of-service conditions.

Impact

Exploitation of this vulnerability causes a buffer overflow, which can lead to arbitrary code execution or a denial-of-service condition on the device.

Reproduction

The vulnerability can be reproduced by sending a POST request to the /goform/formPictureUrl endpoint. The request must include a carefully crafted importPictureURL parameter that exceeds the buffer size, exploiting the lack of boundary checks in the strcpy function.