TOTOLINK EX1800T Stack-Based Buffer Overflow Vulnerability in setPasswordCfg Function

A critical stack-based buffer overflow vulnerability has been identified in the TOTOLINK EX1800T wireless range extender, affecting versions through 9.1.0cu.2112_B20220316. The vulnerability arises in the setPasswordCfg function within the cstecgi.cgi file, where improper handling of the admpass argument allows for remote exploitation.

Impact

Exploitation of this vulnerability leads to a stack-based buffer overflow, which can commonly result in arbitrary code execution or causing the device to crash.

Reproduction

The vulnerability can be reproduced by sending a crafted request to the EX1800T device's web interface, specifically targeting the setPasswordCfg function in the cstecgi.cgi file. The request must include a payload that exceeds the buffer size allocated for the admpass argument, causing a stack-based buffer overflow.