Description

A vulnerability was determined in Linksys E1700 1.0.0.4.003. This vulnerability affects the function ssid1MACFilter of the file /goform/ssid1MACFilter of the component Mac Filter. This manipulation of the argument newap_text_%d causes stack-based buffer overflow. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "10.0",
  "pubDate": "2026-10-12T14:17:09.530Z",
  "pubdate": "2026-10-12T14:17:09.530Z",
  "executiveSummary": "A stack-based buffer overflow vulnerability exists in the Linksys E1700 router, specifically within the Mac Filter component. The flaw is triggered by the improper handling of user-supplied input provided to the 'newap_text_%d' argument in the '/goform/ssid1MACFilter' function. This vulnerability allows an unauthenticated remote attacker to execute arbitrary code or cause a denial-of-service condition by sending a specially crafted request. The absence of vendor response and the public availability of exploit material heighten the risk to device integrity and network security. Successful exploitation grants an attacker control over the device's execution flow, potentially leading to unauthorized access to the local area network or total device compromise. Given the remote accessibility and the potential for remote code execution, this vulnerability is classified as high-risk, necessitating immediate network-level defensive measures.",
  "technicalDetails": "The vulnerability resides in the 'ssid1MACFilter' function located in the '/goform/ssid1MACFilter' file within the Linksys E1700 firmware version 1.0.0.4.003. The root cause is a failure to properly sanitize or validate the length of input data passed to the 'newap_text_%d' argument before copying it into a fixed-size stack buffer.\nThe attack flow begins when an attacker transmits a crafted HTTP POST request to the web interface targeting the '/goform/ssid1MACFilter' endpoint. The request includes parameters following the 'newap_text_%d' pattern (where %d represents an index). The backend handler processes these parameters and utilizes unsafe memory copy operations, such as 'strcpy' or 'sprintf' without boundary checks, to store the input into local buffers allocated on the stack.\nBy providing an input string that exceeds the pre-allocated memory size of the target buffer, an attacker can overwrite adjacent stack memory. This memory corruption allows for the redirection of the function's return pointer. Upon the function's completion, the CPU attempts to return to the overwritten address, enabling the attacker to divert execution to a malicious payload or shellcode embedded within the input string.\nBecause the service is accessible via the device's administrative web interface, the attack can be initiated remotely without requiring prior authentication. The impact is significant: an attacker who successfully controls the instruction pointer can achieve remote code execution (RCE) with the privileges of the web server process, which typically operates with elevated system permissions in embedded Linux environments. Following successful code execution, an attacker may install persistent backdoors, intercept network traffic, or pivot into the internal network protected by the router. Due to the stack-based nature of the overflow, the exploit is sensitive to memory layout and ASLR (Address Space Layout Randomization) protections, if present. However, many legacy router firmwares lack modern exploit mitigations like NX bits or stack canaries, facilitating the reliability of such buffer overflow attacks."
}