D-Link DWR-M920 Stack-Based Buffer Overflow Vulnerability

A stack-based buffer overflow vulnerability has been identified in the D-Link DWR-M920 router, all versions prior to 1.1.50. The issue arises in the function sub_42261C within the file /boafrm/formFilter. The vulnerability can be exploited remotely by manipulating the ip6addr parameter, leading to a crash of the device.

Impact

Exploitation of this vulnerability causes a stack-based buffer overflow, which can potentially be exploited to execute arbitrary code or cause a denial-of-service condition by crashing the device.

Reproduction

To reproduce this vulnerability, send a POST request to the /boafrm/formFilter endpoint. Include a crafted ip6addr parameter with a payload that exceeds the buffer size, effectively overwriting the stack.