D-Link DIR-600L Ax Buffer Overflow Vulnerability in formSetEnableWizard Function

A buffer overflow vulnerability has been identified in the D-Link DIR-600L Ax router, specifically in the firmware version FW116WWb01. The issue arises in the function formSetEnableWizard, where the curTime parameter is processed without proper length validation. This oversight allows for excessive input to be written into a buffer, potentially leading to arbitrary code execution or other malicious outcomes.

Impact

Exploitation of this vulnerability causes a buffer overflow, which can commonly lead to arbitrary code execution or causing the device to crash.

Reproduction

The vulnerability can be reproduced by sending a crafted request to the router's web interface that includes an excessively long curTime parameter. The unvalidated input will be processed by the formSetEnableWizard function, causing a buffer overflow.