TOTOLINK N150RT Buffer Overflow Vulnerability in formWlwds

A critical buffer overflow vulnerability has been identified in the TOTOLINK N150RT router, specifically in the V2_Firmware V3.4.0-B20190525. The issue arises in the file '/boafrm/formWlwds', where the 'submit-url' parameter can be manipulated, leading to a buffer overflow. This vulnerability can be exploited remotely.

Impact

Exploitation of this vulnerability causes a denial-of-service condition, where the device becomes unresponsive and cannot be accessed via the network.

Reproduction

The vulnerability can be reproduced by sending a POST request to the '/boafrm/formWlwds' endpoint with a crafted 'submit-url' parameter that exceeds the buffer size, causing a buffer overflow. This can be done using a tool like Burp Suite. After sending the request, the device's web server will become unresponsive, indicating that the buffer overflow has been successfully exploited.