TP-Link Archer AX10(EU)_V1.2_230220 Buffer Overflow

# Exploit Title: Buffer Overflow in TP-Link Archer AX10(EU)_V1.2_230220# Exploit Author: Giuseppe Compare# Date : 26/05/2023# CVE: CVE-2023-34832# Vendor Homepage: https://www.tp-link.com/# Version: TP-Link Archer AX10(EU)_V1.2_230220Buffer OverflowThere is a buffer overflow in the FUN_131e8 function due to using sprintf improperly, detailed in line 47-49memset(&DAT_000283a4,0,0x800);sprintf(&DAT_000283a4,"echo \'[ %s ] %d: get OCN v6plus rules begin\n \' > /dev/console", "https_get_rules_OCN",0x3c3); system(&DAT_000283a4); //line 47-49sprintf((char *)&local_428, "https://rule.map.ocn.ad.jp/?ipv6Prefix=%s&ipv6PrefixLength=%d&code=e8mMWklYwaGoHmT05ynqVM4kPqF9rAUnhrWCp1vWvBeSOO0pfpMokg==" ,param_2 + 0x23,param_2[0x2d]);The sprintf() function makes no guarantees regarding the length of the generated string, a sufficiently long string passed as an additional argument could generate a buffer overflow.RemediationGuarantee that storage for strings has sufficient space for character data and the null terminator.Avoid using unsafe functions such as sprintf(), consider using snprintf() or sprintf_s() and variants.Double check that your buffer is as large as you specify.Check buffer boundaries if accessing the buffer in a loop and make sure there is no danger of writing past the allocated space.