Vulnerability Title: Stack-Based Buffer Overflow in formWizSurvey via interface1 and interface2 Parameters on Edimax BR-6428nC

Discovered by: tzh00203

Contact Information: [email protected]

Affected Version: Edimax BR-6428nC firmware based on the provided GPL source package (the exact public firmware version string should be confirmed on the test image before submission)

Component: boa wireless wizard handler formWizSurvey

1. Vulnerability Overview

A stack-based buffer overflow vulnerability exists in the wireless survey wizard handler formWizSurvey of Edimax BR-6428nC. The handler copies attacker-controlled request parameters interface1 and interface2 into fixed-size stack buffers using strcpy() with no length checks.

2. Detailed Description

The vulnerable function contains the following local buffers:

char tmpBuf[100], tmpBuf1[100], tmpBuf2[100], tmpBuf3[100], interface[2][200];

When the refresh branch is taken, the code copies request parameters directly:

strcpy(interface[0], websGetVar(wp, T("interface1"), T("")));
strcpy(interface[1], websGetVar(wp, T("interface2"), T("")));

No length validation is performed. Any attacker-controlled string longer than 199 bytes can overflow the corresponding interface entry and corrupt the stack.

Impact