Planet WGS-804HPT Stack Overflow Vulnerability in web_radiusSrv_post Function

A stack overflow vulnerability has been identified in the Planet WGS-804HPT switch, specifically in version 1.305b241111. The issue arises in the web_radiusSrv_post function, where the radIpkey parameter can be manipulated to cause a buffer overflow. This vulnerability allows for control flow hijacking by overflowing the stack and overwriting return addresses.

Impact

Exploitation of this vulnerability leads to a stack overflow, allowing for control flow hijacking. This could potentially be used to execute arbitrary code or cause a denial-of-service condition by crashing the device.

Reproduction

The vulnerability can be reproduced by sending a POST request to the dispatcher.cgi endpoint with a crafted radIpkey parameter. The parameter should be filled with a payload that exceeds the buffer size, causing a stack overflow. This can be automated with a Python script that writes the payload to a file, which is then sent as part of the request.