CVE-2022-41014

Vulnerability

A stack-based buffer overflow exists in the DetranCLI command parsing of Siretta QUARTZ-GOLD firmware version G5.0.1.5-210720-141020 [1]. The vulnerability is in the function that processes the no static dhcp mac WORD (WORD|null) ip A.B.C.D hostname (WORD|null) description (WORD|null) command template. The use of sprintf without bounds checking on user-supplied parameters allows an attacker to overflow a stack buffer [1].

Exploitation

An attacker must have authenticated access to the router's CLI with high privileges (administrator level) [1]. The attacker sends a sequence of requests with overly long parameters for the mac, ip, hostname, or description fields, causing a stack buffer overflow. No user interaction is required beyond the attacker's own actions [1].

Impact

Successful exploitation results in arbitrary command execution with root privileges, leading to full compromise of the device's confidentiality, integrity, and availability [1].

Mitigation

As of the publication date, no official fix has been disclosed in the available references [1]. Users should restrict network access to the CLI interface, enforce strong authentication, and monitor for suspicious activity. Contacting Siretta for firmware updates is recommended.