CVE-2025-41732

Technical Details

CVE-2025-41732 stems from the use of the `sscanf` function within the `check_cookie()` function of the affected WAGO device firmware. The `check_cookie()` function is responsible for parsing cookie data received from incoming network requests. The vulnerability arises because the `sscanf` function is used without proper input validation and bounds checking. Specifically, the format string used in `sscanf` allows an attacker to inject excessively long strings into fixed-size stack buffers. By crafting a malicious cookie with a carefully constructed payload, an attacker can overwrite adjacent memory locations on the stack, including return addresses. This allows the attacker to redirect program execution to arbitrary code, effectively achieving remote code execution (RCE). The lack of authentication required to trigger this vulnerability significantly increases its severity and ease of exploitation. The `sscanf` function, when used incorrectly, is a common source of buffer overflow vulnerabilities. In this case, the absence of length specifiers in the format string allows an attacker to write beyond the allocated buffer size, leading to memory corruption and ultimately, control of the device.

The exploitation process typically involves the following steps: 1) The attacker sends a crafted HTTP request to the WAGO device containing a malicious cookie. 2) The `check_cookie()` function parses the cookie using `sscanf`. 3) The `sscanf` function writes data beyond the bounds of the stack buffer. 4) The attacker overwrites the return address on the stack with the address of their malicious code. 5) When the `check_cookie()` function returns, execution is redirected to the attacker's code, granting them control of the device.