TOTOLINK N150RT Buffer Overflow Vulnerability in WSC Form Processing

A critical buffer overflow vulnerability has been identified in the TOTOLINK N150RT router, specifically in the firmware version 3.4.0-B20190525. The issue arises in the file '/boafrm/formWsc', where the 'localPin' parameter can be manipulated, leading to memory corruption. This vulnerability can be exploited remotely, causing a denial-of-service by crashing the web server.

Impact

Exploitation of this vulnerability leads to a buffer overflow, which can commonly be used to execute arbitrary code or cause a denial-of-service by crashing the device.

Reproduction

The vulnerability can be reproduced by sending a POST request to the '/boafrm/formWsc' endpoint with a crafted 'localPin' parameter that exceeds the buffer size, causing a buffer overflow. This can be done using tools like Burp Suite.