Totolink LR350 Buffer Overflow Vulnerability in setWiFiGuestCfg Function

A buffer overflow vulnerability has been identified in the Totolink LR350 router, specifically in the 9.3.5u.6369_B20220309 firmware version. The issue arises in the 'setWiFiGuestCfg' function within the file '/cgi-bin/cstecgi.cgi', where the 'ssid' argument is manipulated, leading to a stack-based buffer overflow. This vulnerability can be exploited remotely, and a public proof-of-concept exploit is available.

Impact

Exploitation of this vulnerability causes a buffer overflow, which can potentially lead to arbitrary code execution or other malicious actions by overwriting the stack.