Overview
A critical vulnerability has been discovered in Totolink LR1200GB’s version 9.1.0u.6619_B20230130, which may enable remote attackers to initiate a stack-based buffer overflow attack. This vulnerability, named CVE-2024-0571, affects the setSmsCfg function of the file /cgi-bin/cstecgi.cgi. It is of particular concern due to its potential to lead to system compromise or data leakage. The threat is heightened by the fact that the exploit has been publicly disclosed, and no response has been forthcoming from the vendor.
Vulnerability Summary
CVE ID: CVE-2024-0571
Severity: Critical (CVSS: 8.8)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: Potential system compromise or data leakage
Affected Products
No phone number, email, or personal info required.
Product | Affected Versions
Totolink LR1200GB | 9.1.0u.6619_B20230130
How the Exploit Works
The vulnerability is triggered when an attacker manipulates the text argument in the setSmsCfg function of the file /cgi-bin/cstecgi.cgi. This manipulation can lead to a stack-based buffer overflow. A buffer overflow attack occurs when more data is put into a buffer than it can handle, causing it to overflow and overwriting adjacent memory. In this case, remote attackers can exploit this behavior to execute arbitrary code or cause a denial of service.
Conceptual Example Code
Here’s a conceptual example of what a HTTP POST request exploiting this vulnerability might look like:
POST /cgi-bin/cstecgi.cgi HTTP/1.1
Host: target.example.com
Content-Type: application/xml
<setSmsCfg>
<text>AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA...</text>
</setSmsCfg>In this example, ‘A’ is used as a placeholder for the malicious payload that could overflow the buffer.
Mitigation
Until a patch is available from the vendor, it is recommended to use a Web Application Firewall (WAF) or Intrusion Detection System (IDS) as temporary mitigation. These systems can help detect and prevent buffer overflow attacks. However, they are not a permanent solution. Users of the affected product should regularly check for updates from the vendor and apply patches as soon as they become available.