# Firmware Integrity Vulnerability Summary ## Vulnerability Overview During the firmware update process, there is a firmware integrity verification vulnerability. Specifically located in the `platform_do_upgrade_cameo_dev()` function, which performs firmware integrity verification using CRC32, but this verification mechanism can be easily bypassed. An attacker who obtains the CRC32 value can craft malicious firmware with the same CRC32 value, thereby bypassing integrity checks and leading to arbitrary code execution or denial of service. ## Impact Scope - **Affected Products**: TEW-821DAP (Firmware version v1.12B01) ## Remediation - No specific remediation solution is provided on the page. ## POC Code ```c static int platform_do_upgrade_cameo_dev(char *buffer, int len) { int firmware_hdr_addr; int backup_blockaddr; int backup_offset; int backup_size; int backup_addr; int firmware_size; int crc32; int i; if (len 0x1000000) return -1; backup_blockaddr = firmware_hdr_addr & ~0x100000; backup_offset = firmware_hdr_addr & 0x100000; backup_size = 0x100000 - backup_offset; backup_addr = backup_blockaddr + backup_offset; if (platform_do_upgrade_cameo_dev(backup_addr, backup_size) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr +