CVE-2024-0293: Totolink LR1200GB Firmware RCE Vulnerability

CVE-2024-0293 Overview

A critical OS command injection vulnerability was discovered in Totolink LR1200GB router firmware version 9.1.0u.6619_B20230130. The vulnerability exists in the setUploadSetting function within the /cgi-bin/cstecgi.cgi file, where improper sanitization of the FileName argument allows remote attackers to execute arbitrary operating system commands. This flaw can be exploited remotely without authentication, potentially granting attackers complete control over the affected device.

Critical Impact

Remote unauthenticated attackers can execute arbitrary OS commands on affected Totolink LR1200GB routers, leading to complete device compromise, network infiltration, and potential use of the device in botnet operations.

Affected Products

• Totolink LR1200GB Firmware version 9.1.0u.6619_B20230130
• Totolink LR1200GB Hardware

Discovery Timeline

• 2024-01-08 - CVE-2024-0293 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-0293

Vulnerability Analysis

This vulnerability is classified as CWE-78 (OS Command Injection), a severe flaw that allows attackers to inject and execute arbitrary commands on the underlying operating system. The vulnerable function setUploadSetting in /cgi-bin/cstecgi.cgi fails to properly validate or sanitize user-supplied input passed through the FileName parameter. When malicious input containing shell metacharacters or command sequences is provided, the router's firmware passes this unsanitized data directly to system-level command execution functions, allowing attackers to run arbitrary commands with the privileges of the web server process—typically root on embedded devices like this router.

The network-accessible nature of this vulnerability combined with the lack of authentication requirements makes it particularly dangerous. Attackers can exploit this flaw remotely without any prior access to the device, making internet-exposed Totolink LR1200GB routers prime targets for automated scanning and exploitation campaigns.

Root Cause

The root cause of CVE-2024-0293 lies in insufficient input validation within the setUploadSetting function. The FileName argument is processed without proper sanitization to remove or escape shell metacharacters such as semicolons (;), pipes (|), backticks (`), and other command injection sequences. When this unsanitized input is concatenated into a system command string and executed, attackers can break out of the intended command context and inject their own arbitrary commands.

Attack Vector

The attack can be launched remotely over the network against the router's web management interface. An attacker crafts a malicious HTTP request to the /cgi-bin/cstecgi.cgi endpoint, invoking the setUploadSetting function with a specially crafted FileName parameter containing OS command injection payloads. Since no authentication is required to reach this endpoint, any attacker with network access to the router's management interface can exploit this vulnerability.

The exploitation mechanism involves injecting shell commands through the FileName parameter. For example, an attacker might append command separators followed by malicious commands to execute arbitrary code on the device. Technical details and proof-of-concept information are available in the GitHub PoC Repository.

Detection Methods for CVE-2024-0293

Indicators of Compromise

• Unusual HTTP POST requests to /cgi-bin/cstecgi.cgi containing shell metacharacters (;, |, &, `, $()) in the FileName parameter
• Unexpected outbound network connections from the router to unknown external IP addresses
• New user accounts or SSH keys added to the router's filesystem
• Modified startup scripts or cron jobs on the device
• Unusual processes running on the router that are not part of normal firmware operation

Detection Strategies

• Deploy network intrusion detection systems (IDS) with signatures to detect command injection patterns in HTTP traffic to /cgi-bin/cstecgi.cgi
• Monitor HTTP request logs for requests containing suspicious characters or encoding in the FileName parameter
• Implement web application firewall (WAF) rules to block requests with known command injection patterns
• Perform regular firmware integrity checks to detect unauthorized modifications

Monitoring Recommendations

• Enable logging on the router's web management interface and forward logs to a centralized SIEM for analysis
• Monitor for DNS queries to known command-and-control domains from router IP addresses
• Track network traffic anomalies originating from router devices, including unusual protocols or connection volumes
• Set up alerts for configuration changes made to affected Totolink devices

How to Mitigate CVE-2024-0293

Immediate Actions Required

• Restrict access to the router's web management interface to trusted networks only using firewall rules
• Disable remote management access from the WAN/internet if not absolutely required
• Segment the network to isolate potentially compromised devices from critical systems
• Monitor the vendor's website for firmware updates that address this vulnerability

Patch Information

As of the last available information, the vendor (Totolink) was contacted about this vulnerability but did not respond. No official patch is currently available. Organizations should implement compensating controls and consider replacement of affected devices if the vendor does not release a security update. Check VulDB Entry #249859 and the vendor's official support channels for any future patch releases.

Workarounds

• Disable the web management interface entirely if it is not required for operations
• Place the router behind a separate firewall that can filter malicious requests to /cgi-bin/cstecgi.cgi
• Use network access control lists (ACLs) to restrict which IP addresses can access the management interface
• Consider replacing the vulnerable device with a router from a vendor that provides timely security updates

# Example: Restrict management interface access using iptables on upstream firewall
# Block external access to the router's web interface
iptables -A FORWARD -d <ROUTER_IP> -p tcp --dport 80 -j DROP
iptables -A FORWARD -d <ROUTER_IP> -p tcp --dport 443 -j DROP

# Allow only trusted management IPs
iptables -I FORWARD -s <TRUSTED_ADMIN_IP> -d <ROUTER_IP> -p tcp --dport 80 -j ACCEPT