UTT 进取 750W Buffer Overflow Vulnerability in API '/goform/setSysAdm'

A critical buffer overflow vulnerability has been identified in the UTT 进取 750W router, specifically in versions through 5.0. The issue arises in the API component within the '/goform/setSysAdm' file, where the 'strcpy' function is used to copy the 'passwd1' parameter without proper size validation. This vulnerability allows remote exploitation, leading to a stack overflow that could cause a denial-of-service condition.

Impact

Exploitation of this vulnerability causes a stack-based buffer overflow, which can disrupt normal device operation, potentially leading to a denial-of-service condition.

Reproduction

To reproduce this vulnerability, send a crafted request to the '/goform/setSysAdm' endpoint, including an oversized 'passwd1' parameter. The lack of input validation in the 'strcpy' function will trigger the buffer overflow.