CVE-2024-0291 Overview
CVE-2024-0291 is a command injection vulnerability in the Totolink LR1200GB router running firmware version 9.1.0u.6619_B20230130. The flaw resides in the UploadFirmwareFile function within /cgi-bin/cstecgi.cgi. Attackers manipulate the FileName argument to inject operating system commands that execute in the context of the web server process. The vulnerability is remotely exploitable and requires low-privilege authentication. A public disclosure exists under identifier VDB-249857. The vendor was contacted before disclosure but did not respond, leaving the issue unpatched at publication.
Critical Impact
Authenticated remote attackers can execute arbitrary operating system commands on affected Totolink LR1200GB devices, resulting in full compromise of the router.
Affected Products
- Totolink LR1200GB router hardware
- Totolink LR1200GB firmware version 9.1.0u.6619_B20230130
- Deployments exposing the /cgi-bin/cstecgi.cgi endpoint to untrusted networks
Discovery Timeline
- 2024-01-08 - CVE-2024-0291 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-0291
Vulnerability Analysis
The vulnerability is a command injection issue [CWE-77] in the router's Common Gateway Interface (CGI) handler. The UploadFirmwareFile function processes firmware upload requests submitted through /cgi-bin/cstecgi.cgi. The handler accepts a FileName parameter without sufficient sanitization. Attacker-controlled shell metacharacters in this parameter are passed to an underlying command execution routine. Successful exploitation grants command execution with the privileges of the web management daemon, typically root on embedded routers. This allows full device takeover, credential theft, traffic interception, and pivoting into internal networks.
Root Cause
The root cause is missing input validation and unsafe construction of shell commands within the UploadFirmwareFile handler. User-supplied FileName data reaches a command execution primitive without escaping or allowlisting. Any input containing separators such as ;, |, or backticks becomes an injection point.
Attack Vector
An attacker with low-privilege credentials sends a crafted HTTP request to /cgi-bin/cstecgi.cgi invoking the UploadFirmwareFile action. The FileName field carries a payload that appends shell commands after a valid-looking filename. The device executes the injected commands during firmware handling. Public technical details are documented in the GitHub PoC Repository and the VulDB entry #249857.
Detection Methods for CVE-2024-0291
Indicators of Compromise
- HTTP POST requests to /cgi-bin/cstecgi.cgi containing shell metacharacters such as ;, &&, |, or backticks within the FileName parameter.
- Unexpected outbound connections from router management interfaces to attacker infrastructure following firmware upload requests.
- New or modified files in writable partitions of the router filesystem shortly after CGI activity.
Detection Strategies
- Inspect web proxy and firewall logs for anomalous requests to the cstecgi.cgi endpoint originating from unusual source addresses.
- Alert on request bodies referencing UploadFirmwareFile when the FileName parameter contains non-alphanumeric characters beyond . and _.
- Correlate router administrative logins with subsequent firmware upload actions to identify credential abuse.
Monitoring Recommendations
- Forward router syslog and administrative interface logs to a centralized logging platform for retention and analysis.
- Baseline normal management traffic patterns and alert on deviations, especially outbound shell-like activity from the router.
- Monitor for the appearance of the LR1200GB management interface on internet-exposed IP ranges using external attack surface scanning.
How to Mitigate CVE-2024-0291
Immediate Actions Required
- Remove exposure of the LR1200GB web management interface from the internet and restrict access to a dedicated management VLAN.
- Rotate all administrative credentials on affected devices and disable any default or shared accounts.
- Audit devices for signs of compromise, including unexpected processes, cron entries, and modified configuration files.
Patch Information
No vendor patch is available. The vendor was contacted before public disclosure but did not respond, according to the VulDB advisory #249857. Organizations should track vendor firmware release channels for a future fix and consider replacing the device if no update is issued.
Workarounds
- Enforce access control lists on the router so only trusted management workstations can reach /cgi-bin/cstecgi.cgi.
- Place the device behind a network firewall that blocks inbound HTTP and HTTPS requests to the management interface from untrusted networks.
- Where feasible, replace affected LR1200GB units with actively supported hardware that receives security updates.
# Example iptables rule restricting management access to a trusted subnet
iptables -A INPUT -p tcp --dport 80 -s 192.0.2.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -s 192.0.2.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
