漏洞关键信息 基本信息 Vendor: Wavlink Product: NU516U1 Version: WAVLINK-NU516U1-A-WO-20251208-BYFM Type: Stack Buffer Overflow Product Use: USB Printer Server Default Password: admin 漏洞信息 Vulnerable Function: (NAS settings processing) and (character escaping) Vulnerability Point: within function Trigger Parameter: (corresponds to -> in code) Prerequisites: - Attacker must possess a valid login Session (Cookie). - Request parameter must be set to to enter the vulnerable code branch. 漏洞描述 Root Cause: The helper function forcibly prepends a backslash to every character during string processing, causing the data length to expand by a factor of 2. When exceeds 64 bytes, it can easily overflow the 128-byte stack buffer . 漏洞代码片段 测试与验证 Safe Payload: Moderate length Overflow Payload: length increased by just 1 byte Result: HTTP 500 Internal Server Error