WAVLINK Routers Buffer Overflow Vulnerability in HTTP POST Request Handler

A critical buffer overflow vulnerability has been identified in several WAVLINK router models, including the QUANTUM D2G, QUANTUM D3G, WL-WN530G3A, WL-WN530HG3, WL-WN532A3, and WL-WN576K1, all versions through V1410_240222. The vulnerability resides in the sys_login function of the /cgi-bin/login.cgi file, within the HTTP POST Request Handler component. The issue arises from the manipulation of the login_page argument, which leads to a buffer overflow. This vulnerability can be exploited remotely, without any authentication, potentially allowing unauthorized execution of arbitrary commands.

Impact

Exploitation of this vulnerability causes a buffer overflow, which can lead to arbitrary code execution, according to the GitHub advisory.