Shenzhen Libituo Technology LBT-T300-HW1 Buffer Overflow Vulnerability in AP Client Channel Injection

A buffer overflow vulnerability has been identified in the Shenzhen Libituo Technology LBT-T300-HW1 router, affecting versions through 1.2.8. The issue arises in the 'start_lan' function within the '/apply.cgi' file, where the 'Channel' and 'ApCliSsid' arguments can be manipulated, leading to arbitrary command execution. This vulnerability can be exploited remotely.

Impact

Exploitation of this vulnerability causes a stack overflow, which can be leveraged to execute arbitrary commands on the device.

Reproduction

The vulnerability can be reproduced by sending a POST request to '/apply.cgi' with a crafted 'Channel' parameter that exceeds the buffer limit. The 'ApCliSsid' parameter can also be manipulated as part of the exploitation process. This can be done using a script that automates the request, such as one written in Python using the 'requests' library.