CVE-2021-21891

Vulnerability

A stack-based buffer overflow vulnerability exists in the FsBrowseClean functionality of the Lantronix PremierWave 2050 Web Manager application (ltrx_evo) in firmware version 8.9.0.0R4 (in QEMU) [1]. The flaw resides in two conditional calls to sprintf that copy user-controlled input into a fixed-size stack buffer without proper bounds checking. Depending on the action POST parameter (deletedir or deletefile), a different sprintf call is triggered, both of which are exploitable [1]. The function validates that the action, path, and dir parameters are non-empty and that the authenticated user has filesystem permissions before reaching the vulnerable code [1].

Exploitation

An attacker must have valid credentials to authenticate to the Web Manager and possess the filesystem permission level [1]. The attacker sends a specially crafted HTTP POST request to the FsBrowseClean handler with either a deletedir or deletefile action and provides a long string in the path parameter. The server's sprintf call then copies this long string into a fixed-size stack buffer, causing a stack-based buffer overflow [1]. The overflow corrupts the stack frame, allowing the attacker to control the program counter (PC) register. No user interaction beyond authentication is required [1].

Impact

Successful exploitation yields remote code execution (RCE) on the PremierWave 2050 device [1]. The attacker gains full control of the device with the privileges of the Web Manager process, which runs as root. This results in a complete compromise of confidentiality, integrity, and availability (CIA) of the device. The CVSSv3 score is 9.1 (Critical) [1].

Mitigation

As of the publication date (December 2021), no patched firmware version has been released by Lantronix [1]. Users should monitor the vendor's advisory page for updates. Until a fix is available, restrict network access to the Web Manager interface to trusted users only and follow the principle of least privilege for filesystem permissions [1]. This vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.