CVE-2024-28404
📋 TL;DR
This stored cross-site scripting (XSS) vulnerability in TOTOLINK X2000R routers allows attackers to inject malicious scripts into the MAC Filtering configuration page. When administrators view the firewall page, the scripts execute in their browser context, potentially compromising router administration. This affects all users running vulnerable firmware versions.
💻 Affected Systems
- TOTOLINK X2000R
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Administrator account takeover leading to full router compromise, network traffic interception, credential theft, and lateral movement to connected devices.
Likely Case
Session hijacking of administrator accounts, configuration changes, and installation of backdoors on the router.
If Mitigated
Limited impact with proper network segmentation and admin access restrictions, though XSS could still enable limited privilege escalation.
🎯 Exploit Status
Exploitation requires authenticated admin access to inject payload; public proof-of-concept demonstrates the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: V1.0.0-B20231213.1013 or later
Vendor Advisory: https://www.totolink.net/home/menu/detail/menu_listtpl/products/id/242/ids/33.html
Restart Required: Yes
Instructions:
1. Download latest firmware from TOTOLINK website. 2. Log into router admin interface. 3. Navigate to System Tools > Firmware Upgrade. 4. Upload new firmware file. 5. Wait for automatic reboot.
🔧 Temporary Workarounds
Disable MAC Filtering
allRemove or disable MAC filtering functionality to eliminate attack surface
Restrict Admin Access
allLimit router admin interface access to specific IP addresses only
🧯 If You Can't Patch
- Isolate router management interface on separate VLAN with strict access controls
- Implement web application firewall (WAF) with XSS protection rules
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router admin interface under System Status > Firmware VersionCheck Version:
No CLI command; check via web interface at System Status pageVerify Fix Applied:
Confirm firmware version is V1.0.0-B20231213.1013 or later in System Status📡 Detection & Monitoring
Log Indicators:
- Unusual MAC address entries in firewall logs
- Multiple failed login attempts followed by configuration changes
Network Indicators:
- Unexpected JavaScript payloads in HTTP POST requests to /cgi-bin/cstecgi.cgi
- Suspicious outbound connections from router
SIEM Query:
source="router_logs" AND ("MAC Filtering" OR "cstecgi.cgi") AND ("script" OR "javascript" OR "onerror")🔗 References
- https://github.com/4hsien/CVE-vulns/blob/main/TOTOLINK/X2000R/XSS_3_MAC_Filtering/XSS.md
- https://www.totolink.net/home/menu/detail/menu_listtpl/products/id/242/ids/33.html
- https://github.com/4hsien/CVE-vulns/blob/main/TOTOLINK/X2000R/XSS_3_MAC_Filtering/XSS.md
- https://www.totolink.net/home/menu/detail/menu_listtpl/products/id/242/ids/33.html
