Edimax EW-7438RPn webs mp stack-based overflow

Vulnerability

The vulnerability is a stack-based buffer overflow in the webs binary of Edimax EW-7438RPn devices running firmware version 1.31. The mp function within the file /goform/mp copies user-supplied input from the webs parameter into a stack buffer without performing bounds checking, leading to buffer overflow [1].

Exploitation

An unauthenticated remote attacker can exploit this vulnerability by sending a crafted POST request to /goform/mp with an excessively long webs argument. The provided PoC demonstrates that sending a long string causes the device to crash, and due to the overflow, an attacker can overwrite the return address to gain control of code execution [1].

Impact

Successful exploitation allows the attacker to execute arbitrary code on the device, likely with root privileges. This can lead to full compromise of the router's functionality, including data exfiltration, network attacks, or usage as a botnet node [1].

Mitigation

As of the disclosure date, the vendor has not provided a fix or official response. Users of the Edimax EW-7438RPn should restrict network access to the management interface and consider replacing the device if remote access is required. No patch is available for version 1.31 or earlier [1].