# ip-com-14 vendor:IP-COM product:M50 version:V15.11.0.33(10768) type:Buffer Overflow author:Yifeng Li, Wolin Zhuang; ## Vulnerability description We found an buffer overflow vulnerability in IP-COM Technology IP-COM’s M50 routers with firmware which was released recently, allows control rules to attack it. ## Buffer Overflow vulnerability In formIPMacBindAdd function, the parameter “rules” is a value coming from webGetVar, and then in ipMacBindListStore function it is directly strcpy to a local variable placed on the stack, which overrides the return address of the function, causing buffer overflow. ![](https://i.imgur.com/rE2BDfR.png) ![](https://i.imgur.com/yfHv3g4.png) ## PoC ### Buffer Overflow We set the value of “rules” as aaaaaaaaaaaaaaaaaaaaaaaaa…… and the router will cause buffer overflow.