UTT 进取 520W Buffer Overflow Vulnerability in formIpGroupConfig

A buffer overflow vulnerability has been identified in the UTT 进取 520W router, specifically in the 1.7.7-180627 firmware version. The issue arises in the formIpGroupConfig endpoint, where the strcpy function is used to copy the groupName parameter without proper boundary checks. This vulnerability can be exploited remotely, leading to potential denial-of-service conditions.

Impact

Exploitation of this vulnerability causes a buffer overflow, which can be used to execute arbitrary code or cause a denial-of-service condition.

Reproduction

The vulnerability can be reproduced by sending a POST request to the /goform/formIpGroupConfig endpoint. The request must include a groupName parameter with a value that exceeds the buffer's capacity, effectively causing a buffer overflow. This can be done by manipulating the Content-Length header to accommodate the oversized groupName value.