CVE-2023-24236
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary commands on TOTOLink A7100RU routers by injecting malicious commands into the province parameter. Attackers can gain full control of affected devices, potentially compromising entire networks. Only users with TOTOLink A7100RU routers running specific vulnerable firmware are affected.
💻 Affected Systems
- TOTOLink A7100RU
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device takeover leading to network compromise, data exfiltration, ransomware deployment, or use as botnet node for DDoS attacks.
Likely Case
Router compromise allowing traffic interception, credential theft, and lateral movement to connected devices.
If Mitigated
Limited impact with proper network segmentation and firewall rules preventing external access to management interface.
🎯 Exploit Status
Exploit requires authentication to the router's web interface. Public PoC available in GitHub repository.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check TOTOLink website for firmware updates
2. Download latest firmware for A7100RU
3. Access router web interface
4. Navigate to System Tools > Firmware Upgrade
5. Upload new firmware file
6. Wait for reboot (do not interrupt power)
🔧 Temporary Workarounds
Disable WAN Management Access
allPrevent external access to router management interface
Access router web interface > Security > Remote Management > Disable
Network Segmentation
allIsolate router management interface to separate VLAN
🧯 If You Can't Patch
- Replace affected routers with supported models from different vendors
- Implement strict firewall rules blocking all external access to router management ports (typically 80, 443, 8080)
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in web interface: System Tools > Firmware Version. If version is V7.4cu.2313_B20191024, device is vulnerable.Check Version:
curl -s http://router-ip/ | grep -i firmware || ssh admin@router-ip 'cat /etc/version'Verify Fix Applied:
After firmware update, verify version has changed from vulnerable version. Test province parameter with safe payload to confirm command injection is patched.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /setting/delStaticDhcpRules with shell metacharacters in province parameter
- Unexpected command execution in system logs
Network Indicators:
- Unusual outbound connections from router to external IPs
- Traffic patterns suggesting router compromise
SIEM Query:
source="router-logs" AND uri_path="/setting/delStaticDhcpRules" AND (param="province" AND value MATCHES "[;&|`$()]+")