Stack-Based Buffer Overflow in NEXTU FLATA AX1500 Router

The NEXTU FLATA AX1500 router, running firmware version v1.0.2, is vulnerable to a stack-based buffer overflow in its embedded 'boa' web server (CVE-2024-29671). The vulnerability resides within the 'formStaticDHCP' function, which incorrectly handles the 'hostname' parameter during POST requests. The application utilizes the unsafe 'strcpy()' function to process this input without performing necessary bounds checking, allowing an attacker to overwrite the Return (RET) address on the stack. By supplying a crafted payload, an attacker can gain arbitrary code execution with root privileges or induce a denial of service condition. The exploit proof-of-concept specifically targets the MIPS architecture used by the Realtek chipset, demonstrating the injection of shellcode to modify the /etc/passwd file.

Attack Chain

1. An unauthenticated remote attacker identifies the target router exposed to the network.
2. The attacker crafts a malicious HTTP POST request targeting the endpoint /boafrm/formStaticDHCP.
3. The attacker populates the 'hostname' parameter within the request body with a specifically sized payload.
4. The payload consists of an initial padding (gap code) to reach the return address offset.
5. The attacker inserts a malicious return address that points to the injected shellcode.
6. The boa web server processes the request, triggering the vulnerable 'strcpy()' call in the 'formStaticDHCP' function.
7. The stack memory is overflowed, overwriting the return address and hijacking the control flow of the web server process.
8. The router executes the attacker-supplied shellcode with root privileges, leading to unauthorized user creation or persistent compromise.

Impact

Successful exploitation allows unauthenticated remote attackers to achieve complete control over the affected NEXTU FLATA AX1500 router. Impact includes full system compromise with root-level access, the ability to modify system credentials (e.g., adding unauthorized users to /etc/passwd), and the potential for device denial of service. The vulnerability is rated CVSS 9.8, indicating high confidentiality, integrity, and availability impact.

Recommendation

Prioritize the immediate decommissioning or isolation of the NEXTU FLATA AX1500 router from internet-facing networks. Monitor web server logs for HTTP POST requests to /boafrm/formStaticDHCP containing unusually long 'hostname' parameters. Implement network-level access control lists (ACLs) to restrict access to the administrative web interface of these routers to trusted management subnets only.