Totolink LR350 Buffer Overflow Vulnerability in setWiFiEasyGuestCfg Function

A buffer overflow vulnerability has been identified in the Totolink LR350 router running firmware version 9.3.5u.6369_B20220309. The issue arises in the function setWiFiEasyGuestCfg within the file /cgi-bin/cstecgi.cgi. The vulnerability can be exploited remotely by manipulating the ssid argument, leading to a buffer overflow condition.

Impact

Exploitation of this vulnerability causes a buffer overflow, which can commonly lead to arbitrary code execution or causing a crash, but the specific consequences in this case are not detailed.

Reproduction

To reproduce this vulnerability, send a request to the setWiFiEasyGuestCfg function in the /cgi-bin/cstecgi.cgi file, including a crafted ssid argument that exceeds the buffer size limitations. The input should be designed to overwrite adjacent memory on the stack, which can be achieved by including more data than the buffer can safely hold.