TOTOLINK N600R Stack Overflow Vulnerability in setWiFiWpsConfig Function

A stack overflow vulnerability has been identified in the TOTOLINK N600R router, specifically in version V4.3.0cu.7647_B20210106. The issue arises in the cstecgi.cgi file within the cgi-bin directory, where the setWiFiWpsConfig function improperly handles the pin parameter. This vulnerability allows for a sprintf overflow, enabling potential exploitation.

Impact

Exploitation of this vulnerability leads to a stack overflow, which can commonly be used to execute arbitrary code or cause a denial-of-service condition by crashing the device.

Reproduction

The vulnerability can be reproduced by sending a crafted JSON payload to the cstecgi_patch.cgi script. This payload must include a pin value that exceeds the expected length, triggering the stack overflow. The Content-Length header should be set to accommodate the size of the payload.