CVE-2024-0578
📋 TL;DR
A critical stack-based buffer overflow vulnerability in Totolink LR1200GB routers allows remote attackers to execute arbitrary code by manipulating the File parameter in the UploadCustomModule function. This affects all users running the vulnerable firmware version. Successful exploitation could lead to complete device compromise.
💻 Affected Systems
- Totolink LR1200GB
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to full router compromise, credential theft, network pivoting, and persistent backdoor installation.
Likely Case
Remote code execution allowing attacker to reconfigure router, intercept traffic, or join device to botnet.
If Mitigated
Limited impact if device is behind firewall with restricted WAN access and proper network segmentation.
🎯 Exploit Status
Exploit code is publicly available on GitHub. No authentication required to reach vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available - vendor did not respond to disclosure
Restart Required: Yes
Instructions:
No official patch available. Check Totolink website for firmware updates. If update exists: 1. Download firmware from official site 2. Log into router admin 3. Navigate to firmware update section 4. Upload and apply new firmware 5. Reboot router
🔧 Temporary Workarounds
Disable WAN access to admin interface
linuxBlock external access to router management interface
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
Restrict access to vulnerable endpoint
linuxBlock access to /cgi-bin/cstecgi.cgi via firewall rules
iptables -A INPUT -p tcp --dport 80 -m string --string "/cgi-bin/cstecgi.cgi" --algo bm -j DROP
🧯 If You Can't Patch
- Replace affected router with different model or vendor
- Isolate router in separate VLAN with strict firewall rules limiting traffic
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface. If version is exactly 9.1.0u.6619_B20230130, device is vulnerable.Check Version:
curl -s http://router-ip/ | grep -i firmware || login to router admin interfaceVerify Fix Applied:
Verify firmware version has changed from vulnerable version. Test if /cgi-bin/cstecgi.cgi endpoint still accepts malformed File parameter.📡 Detection & Monitoring
Log Indicators:
- Multiple failed upload attempts to /cgi-bin/cstecgi.cgi
- Unusual large file uploads to router interface
- Router configuration changes from unknown source
Network Indicators:
- Unusual outbound connections from router
- Traffic to known exploit hosting domains
- HTTP requests with oversized File parameters
SIEM Query:
source="router.log" AND (uri="/cgi-bin/cstecgi.cgi" AND (bytes>100000 OR status=500))