Ming Yuan

A buffer overflow issue exists in the router's web server, specifically in the httpd. The problem arises when processing the `ntpServer` parameter for a post request. The value of this parameter is directly used in a strcpy to a local variable on the stack, which overrides the return address of the function.

A heap-based buffer overflow issue exists in the router's web server, specifically in the httpd. The issue arises when processing the `mac` parameter for a post request, as its value is directly used in a strcpy to a variable on the heap. This can potentially leak sensitive information or hijack program control flow.

A buffer overflow issue exists in the router's web server, specifically in the httpd. The problem arises when processing the `startIp` and `endIp` parameters for a post request. Each value is directly used in a sprintf to a local variable placed on the stack, which overrides the return address of the function.

A buffer overflow issue exists in the router's web server, specifically in the httpd. The problem arises when processing the `deviceMac` parameter for a post request. The value of this parameter is directly used in a sprintf to a local variable on the stack, which overrides the return address of the function.

A buffer overflow issue exists in the router's web server, specifically in the httpd. The problem arises when processing the `deviceList` parameter for a post request. The value of this parameter is directly used in a strcpy to a local variable on the stack, which overrides the return address of the function.

An issue allows remote code execution via shell metacharacters in the `usbName` field to the ` fastcall` function with a POST request.

A buffer overflow issue exists in the router's web server. The problem occurs when processing the `ssid` parameter for a POST request. The value is directly used in a sprintf call to a local variable placed on the stack, which overrides the return address of the function, causing a buffer overflow.

The issue is related to a Stack-based Buffer Overflow that can be triggered by sending a long `limitSpeed` or `limitSpeedup` parameter to an unspecified `/goform` URI.

The issue allows unauthenticated remote code execution via a request to an unspecified ASP script. Alternatively, an attacker can leverage unauthenticated access to this script to trigger a reboot via an `ifType=reboot` action.