This entry describes a tutorial on buffer overflow exploitation aimed at beginners and new CTF players. It is an educational resource explaining how to exploit a buffer overflow without overwriting the return address, including usage of GDB and techniques for finding offsets. The content is a learning aid rather than a report of a new vulnerability or active threat.
This vulnerability concerns a critical heap buffer overflow (CVE-2026-42945) in NGINX's ngx_http_rewrite_module, which allows unauthenticated remote code execution via crafted rewrite and set directives. The flaw arises from a mismatch in buffer size calculation and copying due to inconsistent handling of the is_args flag, leading to heap overflow and potential corruption of adjacent memory structures. The vulnerability affects multiple versions of NGINX Open Source and NGINX Plus, with fixed versions available. Exploitation requires precise heap manipulation and is demonstrated on Ubuntu 24.04.3 LTS. The exploit code may require adaptation to different OS versions due to changes in memory layout and offsets. No known exploits in the wild have been reported yet.
The TP-Link Tapo C200 security analysis reveals multiple vulnerabilities including hardcoded cryptographic keys and buffer overflow issues. These flaws can potentially allow attackers to bypass authentication, execute arbitrary code, or compromise user privacy. The vulnerabilities are particularly concerning given the device's role as a widely used consumer IP camera, often deployed in home and small business environments. Although no known exploits are currently in the wild, the presence of hardcoded keys significantly lowers the barrier for attackers to exploit these devices. European organizations and consumers using these cameras could face risks of unauthorized surveillance and data breaches. Mitigation requires firmware updates from the vendor, disabling remote access features where possible, and network segmentation to isolate vulnerable devices. Countries with high adoption of TP-Link products and strong smart home market penetration, such as Germany, France, and the UK, are most likely to be affected. Given the ease of exploitation and potential privacy impact, the severity is assessed as high. Defenders should prioritize patching and monitoring for suspicious activity related to these devices.
**TL;DR: Discovered an unpatched zero-day in TP-Link routers (AX10/AX1500) that allows remote code execution. Reported to TP-Link on May 11th, 2024 - still unpatched.4,247 vulnerable devices found online.**
# The Discovery
Used automated taint analysis to find a stack-based buffer overflow in TP-Link's CWMP (TR-069) implementation. The vulnerability exists in function `sub_1e294` that processes SOAP SetParameterValues messages.
**Key Technical Details:**
* Stack buffer: 3072 bytes
* PC register overwrite: 3112 bytes (payload: "A"\*3108 + "BBBB")
* Result: `pc = 0x42424242` (full control)
* Canary exploit mitigations
# Proof of Concept
// Vulnerable code pattern
char* result_2 = strstr(s, "cwmp:SetParameterValues");
// Size calculated from user input - BAD PRACTICE
strncpy(stack_buffer, user_data, calculated_size);
// OVERFLOW!
Exploitation requires setting a malicious CWMP server URL in router config, then device connects and gets pwned.
# Impact
**Affected Models:**
* TP-Link Archer AX10 (all hardware versions V1, V1.2, V2, V2.6)
* TP-Link Archer AX1500 (identical binary)
* Potentially: EX141, Archer VR400, TD-W9970
**Firmware Versions:** 1.3.2, 1.3.8, 1.3.9, 1.3.10 (all vulnerable)
**Internet Exposure:** 4,247 unique IPs confirmed vulnerable via Fofa search
# Why This Matters
Router security is often terrible - default passwords, weak configs, other vulns. Getting config access isn't that hard, and setting up a rogue CWMP server is trivial. Once you change the TR-069 server URL, the router connects to your malicious server and you get root.
# Timeline
* **Discovery:** January 2025 (automated analysis)
* **Vendor Notification:** May 11th, 2024
* **Current Status:** Probably Patched
* **Public Disclosure:** Now
