UTT 进取 520W Buffer Overflow Vulnerability in Web Authentication Global Configuration

A critical buffer overflow vulnerability has been identified in the UTT 进取 520W router, specifically in the firmware version 1.7.7-180627. The issue arises in the 'strcpy' function within the '/goform/formWebAuthGlobalConfig' file. This vulnerability can be exploited remotely, allowing attackers to manipulate parameters and cause a buffer overflow, potentially leading to a denial-of-service condition.

Impact

Exploitation of this vulnerability causes a buffer overflow, which can be used to execute arbitrary code or cause a denial-of-service condition by crashing the device.

Reproduction

The vulnerability can be reproduced by sending a POST request to the '/goform/formWebAuthGlobalConfig' endpoint. The request must include an excessively long 'hidcontact' parameter. This can be done by using a tool like Burp Suite to intercept and modify the request, or by using a script to automate the process.