Heap-based Buffer Overflow Remote Code Execution Vulnerability

CVE-2023-44418

Summary

A vulnerability present in the D-Link DIR-X3260 routers involves a heap-based buffer overflow flaw found within the prog.cgi binary. This binary manages the handling of HNAP requests for the lighttpd webserver. Inadequate validation of user-supplied data lengths before copying them to a fixed-length heap-based buffer exposes a significant risk. Network-adjacent attackers can exploit this issue without requiring authentication, enabling arbitrary code execution in the context of root permissions. The existence of this vulnerability underlines the need for stringent input validation mechanisms to secure devices against unauthorized access.

References