D-Link DIR-600L Buffer Overflow Vulnerability in the formEasySetupWizard3 Function

A critical buffer overflow vulnerability has been identified in the D-Link DIR-600L router, specifically in versions through 2.07B01. The issue arises in the formEasySetupWizard3 function, where the host argument is manipulated. This vulnerability can be exploited remotely, but it only affects products that are no longer supported by the manufacturer.

Impact

Exploitation of this vulnerability leads to a buffer overflow, which can commonly result in arbitrary code execution or causing a denial-of-service condition.

Reproduction

The vulnerability can be reproduced by sending a crafted request that includes a payload exceeding the buffer size limit in the host argument of the formEasySetupWizard3 function. This can be done remotely, taking advantage of the lack of input validation.