CVE-2024-0575: Critical Stack-based Buffer Overflow Vulnerability in Totolink LR1200GB

Overview

A critical vulnerability has been discovered in the Totolink LR1200GB router running firmware version 9.1.0u.6619_B20230130. This vulnerability, identified as CVE-2024-0575, impacts the ‘setTracerouteCfg’ function within the ‘/cgi-bin/cstecgi.cgi’ file. The manipulation of the ‘command’ argument can lead to a stack-based buffer overflow, potentially compromising the system or leading to data leakage. This vulnerability is of particular concern due to its critical severity, the potential for remote exploitation, and the lack of response from the vendor regarding this disclosure.

Vulnerability Summary

CVE ID: CVE-2024-0575
Severity: Critical (CVSS: 8.8)
Attack Vector: Network
Privileges Required: Low
User Interaction: None
Impact: Potential system compromise or data leakage

Affected Products

Product | Affected Versions

Totolink LR1200GB | 9.1.0u.6619_B20230130

How the Exploit Works

The vulnerability stems from insufficient input validation in the ‘setTracerouteCfg’ function of the file ‘/cgi-bin/cstecgi.cgi’. By manipulating the ‘command’ argument, an attacker could trigger a stack-based buffer overflow. This happens when more data is written to a buffer located on the stack than it’s designed to hold. The overflow can overwrite adjacent memory locations, potentially leading to arbitrary code execution or system crashes.

Conceptual Example Code

A conceptual example of how this vulnerability could be exploited is as follows:

POST /cgi-bin/cstecgi.cgi HTTP/1.1
Host: target_router_IP
Content-Type: application/x-www-form-urlencoded
operation=setTracerouteCfg&command=<malicious_payload>

In this example, `` would be replaced with a carefully crafted string designed to cause a buffer overflow. Please note that this is a conceptual example and should not be used for malicious purposes.

Mitigation

Until the vendor provides a patch for this vulnerability, it is recommended to use a Web Application Firewall (WAF) or Intrusion Detection System (IDS) as a temporary mitigation strategy. These systems can help detect and block attempts to exploit this vulnerability. However, this should only be seen as a temporary solution, and users are urged to apply the official patch from the vendor as soon as it becomes available.