CVE-2024-36650
📋 TL;DR
This buffer overflow vulnerability in TOTOLINK AC1200 router firmware allows attackers to send specially crafted HTTP or MQTT requests to the 'setNoticeCfg' function, potentially causing denial-of-service. It affects users of TOTOLINK AC1200 routers running vulnerable firmware versions. The vulnerability stems from improper input validation of the NoticeUrl parameter.
💻 Affected Systems
- TOTOLINK AC1200 Wireless Dual Band Gigabit Router
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete router compromise, persistent backdoor installation, and network infiltration.
Likely Case
Router crash/reboot causing temporary network outage and denial-of-service.
If Mitigated
Limited impact with proper network segmentation and firewall rules blocking external access to router management.
🎯 Exploit Status
Proof-of-concept details are publicly available in the referenced GitHub gist. Exploitation requires sending crafted HTTP/MQTT requests to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check TOTOLINK website for firmware updates. 2. Download latest firmware for AC1200 model. 3. Access router admin panel. 4. Navigate to firmware upgrade section. 5. Upload and apply new firmware. 6. Reboot router after update.
🔧 Temporary Workarounds
Disable remote management
allPrevent external access to router management interface
Access router admin panel -> System -> Remote Management -> Disable
Block vulnerable endpoint
linuxUse firewall rules to block access to the setNoticeCfg CGI function
iptables -A INPUT -p tcp --dport 80 -m string --string "setNoticeCfg" --algo bm -j DROP
iptables -A INPUT -p tcp --dport 443 -m string --string "setNoticeCfg" --algo bm -j DROP
🧯 If You Can't Patch
- Segment router management interface to internal network only
- Implement network monitoring for unusual HTTP/MQTT requests to router
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router admin panel under System Status or Firmware Upgrade sectionCheck Version:
curl -s http://router-ip/cgi-bin/luci/ | grep -i firmware || Check web interface manuallyVerify Fix Applied:
Verify firmware version has been updated to a version newer than A3100R V4.1.2cu.5247_B20211129📡 Detection & Monitoring
Log Indicators:
- Multiple HTTP POST requests to CGI endpoints with long NoticeUrl parameters
- Router crash/reboot logs
- Unusual MQTT connection attempts to router
Network Indicators:
- HTTP requests with unusually long NoticeUrl parameter
- MQTT packets targeting router IP on standard ports
- Traffic patterns indicating buffer overflow attempts
SIEM Query:
source="router_logs" AND (uri="*setNoticeCfg*" OR message="*NoticeUrl*" OR message="*buffer overflow*")