TOTOLINK A7000R Stack-Based Buffer Overflow Vulnerability in WiFi Guest Configuration Function

A stack-based buffer overflow vulnerability has been identified in the TOTOLINK A7000R router, affecting firmware versions through 9.1.0u.6115. The vulnerability arises in the function 'setWiFiEasyGuestCfg' within the file '/cgi-bin/cstecgi.cgi'. The issue occurs because the function does not properly validate the length of the 'ssid5g' parameter before copying it into a fixed-size buffer, allowing for remote exploitation.

Impact

Exploitation of this vulnerability leads to a stack-based buffer overflow, which can commonly result in arbitrary code execution or causing the device to crash.

Reproduction

The vulnerability can be reproduced by sending a POST request to '/cgi-bin/cstecgi.cgi' with a crafted 'ssid5g' parameter that exceeds the buffer size of 128 bytes. This can be done using a web browser or a tool like curl, ensuring that the 'wifiOff5g' parameter is set to '0' and the 'topicurl' parameter is set to 'setWiFiEasyGuestCfg'.