D-Link DIR-825 Buffer Overflow Vulnerability in UPnP AddPortMapping Function

A stack-based buffer overflow vulnerability has been identified in the D-Link DIR-825 router, in versions prior to 3.00b32. The issue arises in the miniupnpd component, specifically within the UPnP SOAP interface's AddPortMapping function. An attacker on the local network can exploit this vulnerability by sending a crafted AddPortMapping request with an oversized NewPortMappingDescription value. The lack of proper length validation allows for memory corruption, as the input is written to a fixed-size stack buffer using sprintf(). This vulnerability only affects devices that are no longer supported by the manufacturer.

Impact

Exploitation of this vulnerability leads to a stack-based buffer overflow, allowing for memory corruption. Such buffer overflow vulnerabilities can often be exploited to execute arbitrary code or cause a denial-of-service condition.