TOTOLINK N600R Stack Overflow Vulnerability in WiFi Configuration

A stack overflow vulnerability has been identified in the TOTOLINK N600R router, specifically in version 4.3.0cu.7866_B20220506. The issue arises in the setWiFiBasicConfig function, where the ssid parameter is improperly handled. This vulnerability allows attackers to craft input that causes a denial-of-service condition by exploiting the buffer overflow.

Impact

Exploitation of this vulnerability leads to a denial-of-service condition, causing the device to become unresponsive or unavailable.

Reproduction

The vulnerability can be reproduced by sending an HTTP request to the 'UploadCustomModule/setWiFiBasicConfig' endpoint with a crafted ssid parameter that exceeds 36 characters. This can be done using a script that simulates the HTTP request with the malicious payload.