Stack Overflow Vulnerability in D-Link DCS-1100 and DCS-1130 Devices

CVE-2017-8412

What is CVE-2017-8412?

A vulnerability has been identified in D-Link DCS-1100 and DCS-1130 devices due to a flawed implementation in the custom binary 'mp4ts' located in the /var/www/video directory. This binary improperly handles user-sent HTTP VERB data, leading to the use of a vulnerable sprintf function without adequate bounds checking. This flaw allows an attacker to manipulate the stack, potentially resulting in arbitrary code execution via a buffer overflow or enabling command injection opportunities.

References