UTT Aggressive 520W Buffer Overflow Vulnerability in FTP Server Directory Configuration

A buffer overflow vulnerability has been identified in the UTT Aggressive 520W router, specifically in firmware versions through v3v1.7.7-180627. The issue arises in the filename parameter of the formFtpServerDirConfig function, where input is not properly validated before being copied, allowing attackers to craft inputs that lead to a denial-of-service condition.

Impact

Exploitation of this vulnerability causes a denial-of-service condition on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to the '/goform/formFtpServerDirConfig' endpoint. Include a 'filename' parameter with a value that exceeds the buffer limit, effectively causing a buffer overflow. The request must also include a valid Digest authorization header.