Security: Stack-based buffer overflow in C_STREAM handler (core/MyProtocol.cpp)

[jasurbek-user]

Summary

A stack-based buffer overflow was identified in the C_STREAM
command handler in core/MyProtocol.cpp.

Affected functions

• protocolSerial2MyMessage
• protocolMQTT2MyMessage

Description

The affected functions decode hex-encoded binary payloads into
a fixed 25-byte stack buffer (bvalue[MAX_PAYLOAD_SIZE]) without
bounds checking. A remote attacker can send a crafted C_STREAM
message with up to 89 hex characters, causing 19 bytes of stack
memory to be overwritten.

Impact

Device crash and potential code execution on ESP32/ESP8266 targets.

Affected versions

All current versions.

CVE

A CVE ID request has been submitted to MITRE and is currently
under review.