D-Link DAP-1620 Heap-Based Buffer Overflow Vulnerability

A critical heap-based buffer overflow vulnerability has been identified in the D-Link DAP-1620 router, specifically in version 1.03. The issue arises in the set_ws_action function within the /dws/api/ file, where improper handling of HTTP request paths can lead to memory overwriting. This vulnerability can be exploited remotely without authentication, potentially causing device crashes, denial-of-service conditions, or even allowing remote code execution.

Impact

Exploitation of this vulnerability can lead to a heap-based buffer overflow, allowing attackers to overwrite memory. This could cause the device to crash, create a denial-of-service condition, or, in some cases, enable remote code execution.

Remediation

It is recommended to use a firewall to block access to the vulnerable function.