固件完整性漏洞总结 漏洞概述 在固件更新过程中，存在固件完整性验证漏洞。具体位于 函数中，该函数通过 CRC32 进行固件完整性验证，但此验证机制容易被绕过。攻击者获取 CRC32 值后，可以构造带有相同 CRC32 值的恶意固件，从而绕过完整性验证，导致任意代码执行或服务拒绝。 影响范围 受影响产品：TEW-821DAP (固件版本 v1.12B01) 修复方案 页面未提供具体的修复方案。 POC代码 ```c static int platform_do_upgrade_cameo_dev(char *buffer, int len) { int firmware_hdr_addr; int backup_blockaddr; int backup_offset; int backup_size; int backup_addr; int firmware_size; int crc32; int i; if (len 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) < 0) return -1; if (firmware_hdr_addr +