CVE-2024-1002
📋 TL;DR
A critical stack-based buffer overflow vulnerability exists in Totolink N200RE routers running firmware version 9.3.5u.6139_B20201216. Attackers can remotely exploit this by sending specially crafted requests to the setIpPortFilterRules function, potentially allowing arbitrary code execution. This affects all users of the vulnerable router firmware.
💻 Affected Systems
- Totolink N200RE
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote attackers gain full control of the router, enabling them to intercept traffic, pivot to internal networks, install persistent malware, or brick the device.
Likely Case
Remote code execution leading to router compromise, network traffic interception, and potential lateral movement to connected devices.
If Mitigated
If properly segmented and monitored, impact limited to router compromise without significant network penetration.
🎯 Exploit Status
Exploit details are publicly available, making weaponization likely. No authentication required for exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: Yes
Instructions:
1. Check Totolink website for firmware updates
2. If update available, download and flash via web interface
3. Factory reset recommended after update
4. Reconfigure router settings
🔧 Temporary Workarounds
Disable Remote Management
allPrevents external exploitation by disabling remote access to router administration
Access router web interface > Administration > Remote Management > Disable
Network Segmentation
allIsolate router on separate VLAN to limit potential lateral movement
🧯 If You Can't Patch
- Replace vulnerable router with different model or updated firmware
- Implement strict network segmentation and firewall rules to limit router access
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in web interface: Login > System > Firmware UpgradeCheck Version:
Check web interface or use nmap -sV to identify router versionVerify Fix Applied:
Verify firmware version is no longer 9.3.5u.6139_B20201216📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /cgi-bin/cstecgi.cgi with setIpPortFilterRules parameter
- Multiple failed exploitation attempts
Network Indicators:
- Unusual traffic to router port 80/443 from external IPs
- POST requests with long ePort parameter values
SIEM Query:
source_ip=external AND dest_port=80 AND uri_path="/cgi-bin/cstecgi.cgi" AND http_method="POST" AND params CONTAINS "setIpPortFilterRules"🔗 References
- https://jylsec.notion.site/TOTOLINK-N200RE-has-stack-buffer-overflow-vulnerability-in-setIpPortFilterRules-71c3f0a947e14b7f95fa19b7d6676994?pvs=4
- https://vuldb.com/?ctiid.252271
- https://vuldb.com/?id.252271
- https://jylsec.notion.site/TOTOLINK-N200RE-has-stack-buffer-overflow-vulnerability-in-setIpPortFilterRules-71c3f0a947e14b7f95fa19b7d6676994?pvs=4
- https://vuldb.com/?ctiid.252271
- https://vuldb.com/?id.252271
