CVE-2022-29377
📋 TL;DR
This vulnerability is a stack buffer overflow in the Totolink A3600R router's infostat.cgi component, triggered via the CONTENT_LENGTH parameter. Attackers can exploit this to cause a Denial of Service (DoS) by crashing the device. Only Totolink A3600R routers running the specific vulnerable firmware version are affected.
💻 Affected Systems
- Totolink A3600R
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device crash requiring physical reboot, potentially leading to extended network downtime and service disruption.
Likely Case
Temporary DoS causing router reboot and brief network interruption for connected devices.
If Mitigated
Minimal impact if device is behind firewall with restricted web interface access.
🎯 Exploit Status
Exploit requires sending crafted HTTP request to infostat.cgi endpoint; no authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not publicly available
Restart Required: No
Instructions:
No official patch available. Check Totolink website for firmware updates and upgrade to latest version if available.
🔧 Temporary Workarounds
Disable Web Interface Access
linuxBlock external access to router's web administration interface
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
Network Segmentation
allIsolate router management interface to trusted network segment
🧯 If You Can't Patch
- Implement strict firewall rules to block all external access to router web interface ports (80, 443, 8080)
- Monitor router logs for unusual HTTP requests to infostat.cgi and implement rate limiting
🔍 How to Verify
Check if Vulnerable:
Check firmware version via router web interface at System Status > Firmware VersionCheck Version:
curl -s http://router-ip/status.cgi | grep FirmwareVerify Fix Applied:
Verify firmware version is different from V4.1.2cu.5182_B20201102📡 Detection & Monitoring
Log Indicators:
- Multiple HTTP POST requests to /infostat.cgi with abnormal CONTENT_LENGTH values
- Router crash/reboot logs
Network Indicators:
- HTTP traffic to router IP on port 80/443 with POST to infostat.cgi and large CONTENT_LENGTH
SIEM Query:
source="router_logs" AND uri="/infostat.cgi" AND method="POST" AND content_length>10000