Shenzhen Libituo Technology LBT-T300-T310 Buffer Overflow Vulnerability in 3G Configuration Function

A critical buffer overflow vulnerability has been identified in Shenzhen Libituo Technology LBT-T300-T310 devices running versions prior to 2.2.3.6. The issue arises in the 'config_3g_para' function within the '/appy.cgi' file, where the 'username_3g' and 'password_3g' parameters can be manipulated, leading to a buffer overflow. This vulnerability can be exploited remotely, and while the vendor was notified of the issue, there has been no response.

Impact

Exploitation of this vulnerability causes a buffer overflow, which can lead to arbitrary code execution or a denial-of-service condition on the device.