TOTOLINK T6 Buffer Overflow Vulnerability in MQTT Service

A critical buffer overflow vulnerability has been identified in the TOTOLINK T6 router, specifically in version 4.1.5cu.748_B20211015. The issue arises in the MQTT service's 'recvSlaveStaInfo' function, where the 'dest' argument can be manipulated, leading to a buffer overflow. This vulnerability can be exploited remotely, with a public exploit available.

Impact

Exploitation of this vulnerability allows for a buffer overflow, which can be used to control the saved return address and potentially execute arbitrary code.

Reproduction

The vulnerability can be reproduced by sending a crafted MQTT message that exploits the 'recvSlaveStaInfo' function. The message must be crafted to manipulate the 'dest' buffer, which is only 4 bytes long. The lack of input length validation in the 'strcpy' function creates the buffer overflow condition, allowing for control over the return address.