CVE-2023-27077
📋 TL;DR
A stack overflow vulnerability in 360 D901 routers allows remote attackers to trigger a Distributed Denial of Service (DDOS) by sending specially crafted HTTP packets. This affects all systems using vulnerable 360 D901 router firmware versions. The vulnerability can disrupt network services without requiring authentication.
💻 Affected Systems
- 360 D901 Router
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete router crash and network outage, requiring physical reboot and causing extended service disruption across all connected devices.
Likely Case
Router becomes unresponsive, requiring manual reboot and causing temporary network downtime for all users.
If Mitigated
Minimal impact with proper network segmentation and rate limiting preventing exploitation attempts.
🎯 Exploit Status
Public GitHub repository contains exploit details and likely working code. No authentication required for exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check 360 router vendor website for firmware updates. 2. Download latest firmware. 3. Upload via router admin interface. 4. Reboot router after update.
🔧 Temporary Workarounds
Disable HTTP Management
allDisable HTTP-based router management interface and use HTTPS only
Router-specific: Access admin interface > Management > Disable HTTP
Network Segmentation
linuxIsolate router management interface to internal network only
iptables -A INPUT -p tcp --dport 80 -s ! 192.168.1.0/24 -j DROP
🧯 If You Can't Patch
- Implement strict network ACLs to restrict access to router management interface
- Deploy rate limiting and DDoS protection at network perimeter
🔍 How to Verify
Check if Vulnerable:
Check router firmware version against known vulnerable versions. Test with controlled exploit if in lab environment.Check Version:
Router-specific: Access admin interface > System > Firmware VersionVerify Fix Applied:
Verify firmware version is updated and test with exploit attempt to confirm no crash occurs.📡 Detection & Monitoring
Log Indicators:
- Multiple HTTP requests with malformed packets
- Router crash/reboot events
- Unusual traffic patterns to router IP
Network Indicators:
- Spike in HTTP traffic to router management port
- Repeated malformed HTTP packets
SIEM Query:
source_ip="router_ip" AND dest_port=80 AND (http_user_agent contains "malformed" OR packet_size>threshold)