UTT Aggressive 520W Buffer Overflow Vulnerability in formConfigCliForEngineerOnly Function Allowing Denial-of-Service

A buffer overflow vulnerability has been identified in the UTT Aggressive 520W router, specifically in firmware versions through v3v1.7.7-180627. The issue arises in the addCommand parameter of the formConfigCliForEngineerOnly function, where lack of proper boundary checks allows attackers to manipulate input and cause a buffer overflow. This vulnerability can be exploited to launch a denial-of-service attack.

Impact

Exploitation of this vulnerability leads to a denial-of-service condition, causing the device to become unresponsive or unavailable.

Reproduction

To reproduce this vulnerability, send a POST request to the /goform/formConfigCliForEngineerOnly endpoint. Include a crafted addCommand parameter with a payload designed to overflow the buffer. The request must be authorized using Digest authentication with valid credentials.