D-Link DIR-600L A1 Buffer Overflow Vulnerability in formSetWizardSelectMode Function

A buffer overflow vulnerability has been identified in the D-Link DIR-600L A1 router running firmware version FW116WWb01. The issue arises in the formSetWizardSelectMode function, where the curTime parameter is processed without proper length validation. This oversight allows for excessive input to be written into a buffer, potentially leading to arbitrary code execution or other malicious outcomes.

Impact

Exploitation of this vulnerability causes a buffer overflow, which can commonly lead to arbitrary code execution or causing the device to crash.

Reproduction

The vulnerability can be reproduced by sending a crafted request to the router's web interface that includes an excessively long curTime parameter. The formSetWizardSelectMode function will process the input without checking its length, causing a buffer overflow.