CVE-2024-0575
📋 TL;DR
CVE-2024-0575 is a critical stack-based buffer overflow vulnerability in Totolink LR1200GB routers that allows remote attackers to execute arbitrary code by sending specially crafted requests to the setTracerouteCfg function. This affects organizations and individuals using vulnerable Totolink LR1200GB routers with internet-facing administration interfaces. Successful exploitation could lead to complete device compromise.
💻 Affected Systems
- Totolink LR1200GB
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote unauthenticated attacker gains full control of the router, enabling traffic interception, network pivoting, persistent backdoor installation, and complete network compromise.
Likely Case
Remote attacker executes arbitrary code with root privileges, potentially installing malware, creating botnet nodes, or disrupting network services.
If Mitigated
If properly segmented and firewalled, impact limited to isolated network segment with no critical systems accessible.
🎯 Exploit Status
Public exploit code available on GitHub. Attack requires sending crafted HTTP POST request to /cgi-bin/cstecgi.cgi with manipulated command parameter.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available - vendor did not respond to disclosure
Restart Required: Yes
Instructions:
No official patch available. Consider replacing affected devices or implementing strict network controls.
🔧 Temporary Workarounds
Network Segmentation and Access Control
linuxBlock external access to router administration interface and restrict internal access to management networks only.
iptables -A INPUT -p tcp --dport 80 -s ! 192.168.1.0/24 -j DROP
iptables -A INPUT -p tcp --dport 443 -s ! 192.168.1.0/24 -j DROP
Disable Vulnerable Functionality
linuxIf possible, disable traceroute functionality or block access to the vulnerable CGI endpoint.
chmod 000 /www/cgi-bin/cstecgi.cgi
rm /www/cgi-bin/cstecgi.cgi
🧯 If You Can't Patch
- Immediately isolate affected routers from internet by placing behind firewalls with strict inbound rules
- Implement network monitoring for unusual traffic patterns to/from router administration interface
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via web interface at System Status > Firmware Version. If version is 9.1.0u.6619_B20230130 or earlier, assume vulnerable.Check Version:
curl -s http://router-ip/ | grep -i 'firmware\|version' or check web interface manuallyVerify Fix Applied:
No official fix available. Verify workarounds by testing that external requests to /cgi-bin/cstecgi.cgi are blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /cgi-bin/cstecgi.cgi
- Large command parameter values in HTTP logs
- Router crash/restart logs
Network Indicators:
- Unusual outbound connections from router
- Traffic spikes to router administration port
- HTTP requests with oversized parameters
SIEM Query:
source="router_logs" AND (url="/cgi-bin/cstecgi.cgi" AND method="POST" AND size(command) > 1000)