Skip to content

Commit

Permalink
Update upnp_stack_overflow.md
Browse files Browse the repository at this point in the history
  • Loading branch information
reevesrs24 authored Jul 28, 2019
1 parent 48d58ed commit 6605aa2
Showing 1 changed file with 1 addition and 1 deletion.
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@
**PoC Script**: [netgear_upnp_poc.py](https://github.com/reevesrs24/CVE/blob/master/Netgear_WNDR2400v3/upnp_stack_overflow/netgear_upnp_poc.py)
## Vulnerability details ##

1. There exists a buffer overflow in the ssdp_http_method_check function in the upnpd binary.
1. There exists a stack-based buffer overflow in the ssdp_http_method_check function in the upnpd binary.
![alt text](screenshots/ghidra_upnp.png)

2. Sending a crafted UPnP SSDP packet allows for the $ra register to be overwritten.
Expand Down

0 comments on commit 6605aa2

Please sign in to comment.