CVE-2024-0294
📋 TL;DR
This critical vulnerability in Totolink LR1200GB routers allows remote attackers to execute arbitrary operating system commands through command injection in the setUssd function. Attackers can exploit this to gain full control of affected devices. Only Totolink LR1200GB routers running specific firmware versions are affected.
💻 Affected Systems
- Totolink LR1200GB
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attackers to install persistent backdoors, pivot to internal networks, intercept traffic, or use the device for botnet activities.
Likely Case
Remote code execution leading to device takeover, credential theft, and network reconnaissance.
If Mitigated
Limited impact if devices are behind firewalls with strict inbound filtering and network segmentation.
🎯 Exploit Status
Public exploit code is available on GitHub. The attack requires no authentication and is simple to execute.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch is available. The vendor did not respond to disclosure attempts. Consider replacing affected devices or implementing workarounds.
🔧 Temporary Workarounds
Disable Web Management Interface
allDisable the vulnerable web interface to prevent remote exploitation
Access router CLI via SSH/Telnet
Navigate to web interface settings
Disable web management or restrict to local network only
Network Access Control
linuxRestrict access to router management interface using firewall rules
iptables -A INPUT -p tcp --dport 80 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Isolate affected routers in a separate VLAN with strict network segmentation
- Implement outbound traffic monitoring to detect command and control activity
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via web interface at System Status > Firmware Version or via CLI command: cat /proc/versionCheck Version:
cat /proc/version or check web interface at System Status > Firmware VersionVerify Fix Applied:
Test if the setUssd endpoint is still accessible and vulnerable by attempting to access /cgi-bin/cstecgi.cgi with ussd parameter📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /cgi-bin/cstecgi.cgi with ussd parameter
- Suspicious command execution in system logs
- Failed authentication attempts followed by successful exploitation
Network Indicators:
- Unusual outbound connections from router to unknown IPs
- Traffic patterns indicating command and control communication
- Port scanning originating from router
SIEM Query:
source="router_logs" AND (uri="/cgi-bin/cstecgi.cgi" AND parameter="ussd") OR (process="sh" OR process="bash" AND parent_process="httpd")