D-Link DIR-600L A1 Buffer Overflow Vulnerability in formSetWizard1 Function

A buffer overflow vulnerability has been identified in the D-Link DIR-600L A1 router running firmware version FW116WWb01. The issue arises in the formSetWizard1 function, where the curTime parameter is processed without proper length validation, allowing for excessive input to overflow the buffer.

Impact

Exploitation of this vulnerability leads to a buffer overflow, which can commonly result in arbitrary code execution or causing the device to crash.

Reproduction

The vulnerability can be reproduced by sending a crafted request to the router's formSetWizard1 function. The curTime parameter must be included in the request, with a payload that exceeds the buffer's capacity. This can be done using a variety of tools that allow for the manipulation of HTTP request parameters.