Netgear R6100 Buffer Overflow Vulnerability Allowing Remote Code Execution

A buffer overflow vulnerability has been identified in the Netgear R6100 router, specifically in firmware version 1.0.1.28. This vulnerability allows remote attackers to execute arbitrary code by manipulating the QUERY_STRING key value, leading to a stack overflow via a vulnerable sprintf function. The issue arises in the cgiMain component of the router's web interface.

Impact

Exploitation of this vulnerability allows remote, unauthenticated attackers to execute arbitrary code on the affected device, potentially leading to full control over the router.

Reproduction

The vulnerability can be reproduced by sending a crafted QUERY_STRING value that exceeds the buffer limit, causing a stack overflow. This can be done using a QEMU simulation that mimics the router's environment. The 'CONTENT_LENGTH' environment variable should be empty, and the 'cgiMain' application must be executed with the '-f' flag.