D-Link DIR-600L Ax Buffer Overflow Vulnerability in formSetEasy_Wizard Function

A buffer overflow vulnerability has been identified in the D-Link DIR-600L Ax router, specifically in the firmware version FW116WWb01. The issue arises in the formSetEasy_Wizard function, where the curTime parameter is processed without proper length validation. This oversight allows for excessive input to be written into memory, potentially leading to arbitrary code execution or other malicious outcomes.

Impact

Exploitation of this vulnerability causes a buffer overflow, which can commonly lead to arbitrary code execution or memory corruption.

Reproduction

The vulnerability can be reproduced by sending a crafted request to the router's formSetEasy_Wizard function, including a curTime parameter that exceeds the expected length. The lack of input validation in this parameter allows for the buffer overflow to occur, as the input is improperly copied into memory without checking its size.