Executive brief
A security vulnerability exists in the D-Link DIR-878A1 router, a device used to provide internet connectivity in homes and small offices. The flaw is located in how the router processes information from connected USB storage devices. An attacker with physical access to the router could use a specially crafted USB device to crash the system or potentially take full control of the equipment, leading to unauthorized access to the network or data interception.
Technical details
A stack-based buffer overflow (CWE-121) exists in the 'rc' binary of D-Link DIR-878A1 firmware version FW101B04.bin. The vulnerability is located in the USB storage handling module, specifically within a function that processes device information from /proc/scsi/usb-storage/. The 'fgets' function reads up to 127 bytes from the device's "Serial Number" field into a temporary buffer, which is then passed to 'sscanf' and copied into a fixed 64-byte stack buffer (v17). Because 'sscanf' does not perform bounds checking, providing a serial number longer than 64 bytes results in a stack overflow. An attacker with physical access or the ability to emulate a USB device can exploit this to overwrite the return address and achieve arbitrary code execution.
Affected products
- D-Link DIR-878A1 FW101B04.bin
Timeline
- 2025-11-13: disclosed: Initial disclosure via MITRE/NVD
- 2025-11-13: advisory