CVE-2024-0573
📋 TL;DR
A critical stack-based buffer overflow vulnerability in Totolink LR1200GB routers allows remote attackers to execute arbitrary code by manipulating the 'ip' parameter in the setDiagnosisCfg function. This affects users running firmware version 9.1.0u.6619_B20230130. Successful exploitation could lead to complete device compromise.
💻 Affected Systems
- Totolink LR1200GB
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to full router compromise, credential theft, network pivoting, and persistent backdoor installation.
Likely Case
Router takeover enabling traffic interception, DNS manipulation, and network disruption.
If Mitigated
Limited impact if device is isolated behind firewalls with strict network segmentation.
🎯 Exploit Status
Exploit code is publicly available in GitHub repositories, making attacks straightforward for threat actors.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: Yes
Instructions:
No official patch available. Contact Totolink support for firmware updates. If update becomes available, download from official vendor site, upload via web interface, and reboot device.
🔧 Temporary Workarounds
Network Isolation
allPlace vulnerable routers behind firewalls with strict inbound rules
Access Restriction
allBlock access to /cgi-bin/cstecgi.cgi via web application firewall or router ACLs
🧯 If You Can't Patch
- Replace vulnerable devices with supported models from different vendors
- Implement network segmentation to isolate vulnerable routers from critical assets
🔍 How to Verify
Check if Vulnerable:
Check firmware version via router web interface at System Status > Firmware VersionCheck Version:
No CLI command available - use web interface or check via HTTP request to router management pageVerify Fix Applied:
Verify firmware version has changed from 9.1.0u.6619_B20230130 to a newer version📡 Detection & Monitoring
Log Indicators:
- Multiple POST requests to /cgi-bin/cstecgi.cgi with long ip parameter values
- Unusual process execution or memory errors in router logs
Network Indicators:
- Unusual outbound connections from router
- Traffic to known exploit repositories
SIEM Query:
source_ip="router_ip" AND url_path="/cgi-bin/cstecgi.cgi" AND http_method="POST" AND content_length>1000