CVE-2022-41007

Vulnerability

A stack-based buffer overflow vulnerability exists in the port redirect protocol command parser of the DetranCLI binary on Siretta QUARTZ-GOLD routers running firmware version G5.0.1.5-210720-141020 [1]. The flaw occurs when the sprintf() function copies user-supplied parameters (e.g., tcp|udp|tcp/udp, inport <1-65535>, dstaddr A.B.C.D, export <1-65535>, description WORD) into a fixed-size stack buffer without proper bounds checking [1]. This pattern affects the command template 'port redirect protocol (tcp|udp|tcp/udp) inport <1-65535> dstaddr A.B.C.D export <1-65535> description WORD' [1].

Exploitation

An attacker must have administrative access (High privileges) to the router's CLI [1]. The attacker sends a sequence of specially-crafted network packets containing excessively long parameters in the port redirect command [1]. The vulnerable sprintf() call overflows the stack buffer [1]. No user interaction beyond authentication is required [1].

Impact

Successful exploitation allows arbitrary command execution on the device with root privileges [1]. The attacker can fully compromise confidentiality, integrity, and availability of the router (CVSS 7.2, HIGH) [1].

Mitigation

As of publication date 2023-01-26, no fixed version was available from Siretta [1]. The affected firmware G5.0.1.5-210720-141020 remains vulnerable with no known workaround [1]. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog as of that date [1].