CVE-2024-1000
📋 TL;DR
A critical stack-based buffer overflow vulnerability in the Totolink N200RE router's web interface allows remote attackers to execute arbitrary code by sending specially crafted requests to the setTracerouteCfg function. This affects users of Totolink N200RE routers with vulnerable firmware versions, potentially giving attackers full control of the device. The vulnerability is remotely exploitable without authentication.
💻 Affected Systems
- Totolink N200RE
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, creation of persistent backdoors, network pivoting to internal systems, and botnet recruitment.
Likely Case
Remote code execution allowing attackers to modify router settings, intercept network traffic, or use the device for DDoS attacks.
If Mitigated
Limited impact if device is behind firewall with restricted WAN access, though internal attackers could still exploit.
🎯 Exploit Status
Public exploit details available in disclosed references. The vulnerability requires no authentication and has straightforward exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available - vendor did not respond to disclosure
Restart Required: Yes
Instructions:
No official patch available. Check Totolink website for firmware updates. If update available: 1. Download firmware from official site 2. Log into router admin interface 3. Navigate to firmware update section 4. Upload and apply new firmware 5. Reboot router
🔧 Temporary Workarounds
Disable Remote Management
allDisable WAN access to router management interface
Login to router admin > Advanced Settings > Remote Management > Disable
Network Segmentation
allPlace router on isolated network segment with restricted access
🧯 If You Can't Patch
- Replace affected Totolink N200RE router with different model/brand
- Implement strict network firewall rules blocking all external access to router management interface (ports 80, 443, 8080)
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via admin interface: System Status > Firmware Version. If version is 9.3.5u.6139_B20201216 or earlier, likely vulnerable.Check Version:
curl -s http://router-ip/ | grep -i firmware OR check web interface manuallyVerify Fix Applied:
Verify firmware version has been updated to a version later than 9.3.5u.6139_B20201216. Test by attempting to access /cgi-bin/cstecgi.cgi with setTracerouteCfg parameter (in controlled environment).📡 Detection & Monitoring
Log Indicators:
- Multiple POST requests to /cgi-bin/cstecgi.cgi with setTracerouteCfg parameter
- Unusual command execution in router logs
- Buffer overflow error messages in system logs
Network Indicators:
- Unusual outbound connections from router IP
- Traffic to known exploit servers
- HTTP requests with long command parameters to router management interface
SIEM Query:
source="router_logs" AND (uri="/cgi-bin/cstecgi.cgi" AND params CONTAINS "setTracerouteCfg") OR (message CONTAINS "buffer overflow" AND device="N200RE")🔗 References
- https://jylsec.notion.site/TOTOLINK-N200RE-has-stack-buffer-overflow-vulnerability-in-setTracerouteCfg-b6b3fe05b4a945a3bc460dbcb61dfc75?pvs=4
- https://vuldb.com/?ctiid.252269
- https://vuldb.com/?id.252269
- https://jylsec.notion.site/TOTOLINK-N200RE-has-stack-buffer-overflow-vulnerability-in-setTracerouteCfg-b6b3fe05b4a945a3bc460dbcb61dfc75?pvs=4
- https://vuldb.com/?ctiid.252269
- https://vuldb.com/?id.252269
