D-Link DIR-600LAx Buffer Overflow Vulnerability in formSetQoS Function

A buffer overflow vulnerability has been identified in the D-Link DIR-600LAx router running firmware version FW116WWb01. The issue arises in the formSetQoS function, where the curTime parameter is processed without proper length validation. This oversight allows for excessive input to be written into a buffer, potentially leading to arbitrary code execution or other malicious outcomes.

Impact

Exploitation of this vulnerability causes a buffer overflow, which can commonly lead to arbitrary code execution or causing the device to crash.

Reproduction

The vulnerability can be reproduced by sending a crafted request to the router's formSetQoS function. The curTime parameter should be included with a payload that exceeds the buffer's capacity, bypassing the length checks implemented by the sprintf function. This can be done using a variety of tools that allow for the manipulation of HTTP request parameters.