CVE-2023-36955
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on TOTOLINK CP300+ routers by exploiting a stack overflow in the UploadCustomModule function. Attackers can achieve full system compromise by sending specially crafted requests. All users running affected firmware versions are vulnerable.
💻 Affected Systems
- TOTOLINK CP300+
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system takeover with root privileges, enabling persistent backdoor installation, network traffic interception, and lateral movement to other devices.
Likely Case
Remote code execution leading to router compromise, credential theft, DNS hijacking, and botnet recruitment.
If Mitigated
Limited impact with proper network segmentation and firewall rules blocking external access to router management interfaces.
🎯 Exploit Status
Public proof-of-concept available in GitHub repository. Exploitation requires sending HTTP request with malicious File parameter to vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check TOTOLINK website for firmware updates
2. Download latest firmware if available
3. Access router web interface
4. Navigate to firmware upgrade section
5. Upload and install new firmware
6. Reboot router
🔧 Temporary Workarounds
Disable remote management
allPrevent external access to router web interface
Access router settings → Administration → Remote Management → Disable
Restrict management interface access
allLimit access to router management to trusted IPs only
Access router settings → Security → Access Control → Add trusted IP ranges
🧯 If You Can't Patch
- Segment router management interface to isolated VLAN
- Implement WAF rules to block requests with suspicious File parameter patterns
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router web interface: Login → Status → Device Info → Firmware VersionCheck Version:
curl -s http://router-ip/status.cgi | grep firmware_versionVerify Fix Applied:
Verify firmware version is newer than V5.2cu.7594_B20200910📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to UploadCustomModule endpoint with large File parameter
- Router crash/reboot logs
- Unusual process execution in router logs
Network Indicators:
- HTTP traffic to router management port with suspicious upload patterns
- Outbound connections from router to unknown IPs
SIEM Query:
source="router_logs" AND (uri="/cgi-bin/UploadCustomModule" OR method="POST" AND file_size>1000000)