CVE-2024-0576: Critical Vulnerability in Totolink LR1200GB Leading to Potential System Compromise

Overview

A critical vulnerability has been discovered in the Totolink LR1200GB 9.1.0u.6619_B20230130, a widely used router model. This vulnerability, identified as CVE-2024-0576, allows malicious actors to exploit a buffer overflow issue in the function setIpPortFilterRules of the file /cgi-bin/cstecgi.cgi. The vulnerability is particularly alarming due to its high severity, remote exploitability, and the lack of response from the vendor, putting numerous systems at risk of compromise or data leakage.

Vulnerability Summary

CVE ID: CVE-2024-0576
Severity: Critical (CVSS 8.8)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: Potential system compromise or data leakage

Affected Products

Product | Affected Versions

Totolink LR1200GB | 9.1.0u.6619_B20230130

How the Exploit Works

The vulnerability lies within the setIpPortFilterRules function of the file /cgi-bin/cstecgi.cgi. An attacker can manipulate the argument sPort, which leads to a stack-based buffer overflow. A buffer overflow occurs when more data is written to a buffer than it can handle, leading to the overflow of the extra data into adjacent memory areas. In this case, an attacker can remotely initiate the attack, exploiting the overflow to execute arbitrary code, potentially leading to system compromise or data leakage.

Conceptual Example Code

Here is a
conceptual
example of how the vulnerability might be exploited. This could be a crafted HTTP POST request:

POST /cgi-bin/cstecgi.cgi HTTP/1.1
Host: target.example.com
Content-Type: application/x-www-form-urlencoded
setIpPortFilterRules=sPort[99999]=malicious_payload

In this example, the `sPort` argument is filled with a large quantity of data, leading to a buffer overflow. The `malicious_payload` would be the attacker’s code designed to take advantage of the overflow to achieve their goal.

Mitigation Guidance

Until the vendor provides a patch for this vulnerability, users are advised to implement a Web Application Firewall (WAF) or Intrusion Detection System (IDS) as temporary mitigation. These systems can help detect and block attempts to exploit the vulnerability. However, they should not be seen as a permanent solution. Users are encouraged to apply the vendor patch as soon as it becomes available for comprehensive protection.