CVE-2024-27572
📋 TL;DR
This vulnerability allows attackers to cause a Denial of Service (DoS) on LBT T300-T390 routers by sending a specially crafted POST request that triggers a stack overflow. The attack exploits improper input validation in the ApCliSsid parameter. Organizations using these specific router models with vulnerable firmware are affected.
💻 Affected Systems
- LBT T300-T390 routers
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete router crash requiring physical reboot, potentially disrupting all network services for connected devices.
Likely Case
Router becomes unresponsive, requiring manual reboot and causing temporary network outage.
If Mitigated
No impact if routers are not internet-facing or have proper input validation controls.
🎯 Exploit Status
Public GitHub repository contains details about the vulnerability. Crafted POST requests can trigger the overflow without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: No
Instructions:
Check with LBT vendor for firmware updates. If available, download and apply the latest firmware through the router's web interface.
🔧 Temporary Workarounds
Network Segmentation
allIsolate vulnerable routers from untrusted networks
Access Control
linuxRestrict access to router management interface
iptables -A INPUT -p tcp --dport 80 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
🧯 If You Can't Patch
- Replace vulnerable routers with updated models
- Implement network monitoring for suspicious POST requests to router interfaces
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in web interface or via SSH: cat /proc/versionCheck Version:
cat /proc/version or check web interface System StatusVerify Fix Applied:
Verify firmware version has been updated beyond v2.2.1.8📡 Detection & Monitoring
Log Indicators:
- Router crash logs
- Unusual POST requests to management interface
- System reboot events
Network Indicators:
- Unusual HTTP POST traffic to router IP on port 80/443
- Router becoming unresponsive to ping
SIEM Query:
source="router_logs" AND ("POST /updateCurAPlist" OR "ApCliSsid" OR "router crash")