CVE-2024-10654
📋 TL;DR
This vulnerability allows remote attackers to bypass authentication on TOTOLINK LR350 routers by manipulating the authCode parameter in the /formLoginAuth.htm endpoint. Attackers can gain unauthorized access to router administration without valid credentials. All users running affected firmware versions are vulnerable.
💻 Affected Systems
- TOTOLINK LR350
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete router compromise allowing attacker to change network settings, intercept traffic, install malware, or use router as pivot point into internal network.
Likely Case
Unauthorized access to router admin panel enabling network configuration changes, DNS hijacking, or credential theft.
If Mitigated
Limited impact if router is behind firewall with restricted WAN access and strong internal network segmentation.
🎯 Exploit Status
Exploit requires sending HTTP request with authCode=1 parameter to vulnerable endpoint. Public proof-of-concept available in GitHub repository.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 9.3.5u.6698_B20230810
Vendor Advisory: https://www.totolink.net/
Restart Required: Yes
Instructions:
1. Download firmware version 9.3.5u.6698_B20230810 from TOTOLINK website. 2. Log into router admin panel. 3. Navigate to System Tools > Firmware Upgrade. 4. Upload new firmware file. 5. Wait for upgrade to complete and router to reboot.
🔧 Temporary Workarounds
Restrict WAN Access
linuxBlock external access to router admin interface using firewall rules
iptables -A INPUT -p tcp --dport 80 -s ! INTERNAL_NETWORK -j DROP
iptables -A INPUT -p tcp --dport 443 -s ! INTERNAL_NETWORK -j DROP
Disable Remote Management
allTurn off remote administration feature in router settings
🧯 If You Can't Patch
- Isolate affected routers in separate VLAN with strict access controls
- Implement network monitoring for unauthorized access attempts to /formLoginAuth.htm
🔍 How to Verify
Check if Vulnerable:
Send HTTP GET request to http://ROUTER_IP/formLoginAuth.htm?authCode=1 and check if admin access is granted without credentialsCheck Version:
Check router web interface System Status page or use curl -s http://ROUTER_IP/ | grep -i versionVerify Fix Applied:
Attempt same exploit after upgrade - should receive authentication error or redirect to login page📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /formLoginAuth.htm with authCode parameter
- Successful admin logins from unusual IP addresses
- Multiple failed login attempts followed by successful auth bypass
Network Indicators:
- HTTP traffic to router IP on port 80/443 containing 'authCode=1' parameter
- Unusual admin panel access patterns
SIEM Query:
source="router_logs" AND (uri="/formLoginAuth.htm" OR (uri="/" AND status=200 AND referer CONTAINS "formLoginAuth.htm"))