SSD Advisory - TP-LINK VIGI onvif_discovery Overflow

tags:iotroutertp-linkstack_overflowrop original link: SSD Advisory: TP-LINK VIGI onvif_discovery Overflow newsletter link: exploits.club Weekly Newsletter 26

---

Exploits Club Summary:

SSD Secure Disclosure team released a write-up for a buffer overflow on TP-Link’s VIGI security camera. The vulnerability resides in onvif_discovery, which listens on port 5001 and is reachable while unauthenticated. The root cause for the vulnerability here is pretty straightforward, as attacker-controlled data is copied from one stack buffer to another, smaller buffer without performing any sort of bounds checking. The advisory walks through the call stack and shows the RE where the vulnerability resides. While it doesn’t go in-depth on the exploitation, it provides a full PoC, which looks to do some standard ROP.