CVE-2024-0294: Totolink LR1200GB Firmware RCE Vulnerability

CVE-2024-0294 Overview

A critical OS command injection vulnerability has been discovered in the Totolink LR1200GB router firmware version 9.1.0u.6619_B20230130. This vulnerability exists in the setUssd function within the /cgi-bin/cstecgi.cgi endpoint, where improper handling of the ussd argument allows attackers to inject and execute arbitrary operating system commands. The attack can be launched remotely without authentication, potentially giving attackers complete control over the affected device.

Critical Impact

Remote attackers can exploit this command injection vulnerability to execute arbitrary commands on the Totolink LR1200GB router with elevated privileges, leading to complete device compromise, network infiltration, and potential use of the device in botnet operations.

Affected Products

• Totolink LR1200GB Firmware version 9.1.0u.6619_B20230130
• Totolink LR1200GB Hardware

Discovery Timeline

• 2024-01-08 - CVE-2024-0294 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-0294

Vulnerability Analysis

This vulnerability falls under CWE-78 (OS Command Injection), a critical class of security flaws where user-supplied input is improperly incorporated into operating system commands. In the Totolink LR1200GB router, the setUssd function fails to properly sanitize the ussd parameter before passing it to a system shell for execution.

The vulnerability is particularly dangerous because it requires no authentication and can be exploited remotely over the network. An attacker who successfully exploits this flaw gains the ability to execute arbitrary commands with the same privileges as the web server process, which typically runs with root or elevated privileges on embedded devices like routers.

The public disclosure of this vulnerability, combined with the vendor's failure to respond to disclosure attempts, significantly increases the risk to affected devices. Organizations using this router model should treat this as an immediate security priority.

Root Cause

The root cause of this vulnerability is insufficient input validation and sanitization in the setUssd function. The function accepts user-controlled input via the ussd argument and passes it directly to a system command without proper escaping or filtering of shell metacharacters. This allows attackers to break out of the intended command context and inject their own malicious commands.

Common shell metacharacters that may be leveraged include semicolons (;), pipe characters (|), backticks (`), and command substitution syntax ($()), which can be used to append or chain additional commands to the original system call.

Attack Vector

The attack vector is network-based, targeting the /cgi-bin/cstecgi.cgi endpoint on the router's web management interface. An attacker can craft a malicious HTTP request containing specially crafted input in the ussd parameter. When processed by the setUssd function, the malicious payload is executed as part of a system command.

The vulnerability can be exploited by sending a crafted request to the CGI endpoint with command injection payloads embedded in the ussd parameter. Shell metacharacters allow the attacker to terminate the original command and append arbitrary commands that will be executed by the underlying operating system. Successful exploitation grants the attacker the ability to execute any command on the device, potentially leading to full system compromise. For detailed technical information, see the GitHub Vulnerability Documentation.

Detection Methods for CVE-2024-0294

Indicators of Compromise

• Unexpected outbound network connections from the router to unknown IP addresses
• Modified router configuration or unauthorized administrative accounts
• Unusual processes running on the device detected through firmware analysis
• HTTP request logs showing suspicious patterns in requests to /cgi-bin/cstecgi.cgi with the ussd parameter containing shell metacharacters

Detection Strategies

• Monitor network traffic for HTTP requests targeting /cgi-bin/cstecgi.cgi with unusual or malformed ussd parameter values
• Implement intrusion detection rules to flag requests containing common command injection patterns (;, |, $(), backticks) in router-bound traffic
• Deploy network segmentation to isolate IoT devices and routers, enabling better visibility into anomalous traffic patterns
• Regularly audit router configurations for unauthorized changes

Monitoring Recommendations

• Enable logging on the router if supported and forward logs to a central SIEM for analysis
• Monitor for unexpected DNS queries or connections to known malicious infrastructure originating from the router
• Implement network behavior analysis to detect command-and-control communication patterns typical of compromised IoT devices

How to Mitigate CVE-2024-0294

Immediate Actions Required

• Restrict access to the router's web management interface to trusted IP addresses only using firewall rules
• Disable remote management if it is not required for operations
• Place the affected router behind a separate firewall that can filter malicious requests
• Consider replacing the vulnerable device with a supported alternative if no patch becomes available

Patch Information

At the time of disclosure, the vendor (Totolink) was contacted but did not respond. No official patch is currently available for this vulnerability. Users should monitor VulDB and the vendor's website for any future security updates.

Workarounds

• Implement network-level access controls to restrict who can reach the /cgi-bin/cstecgi.cgi endpoint
• Deploy a web application firewall (WAF) or reverse proxy in front of the router's management interface to filter requests containing command injection patterns
• Disable the web management interface entirely if remote administration is not required
• Segment the network to isolate the vulnerable router from critical systems and sensitive data

# Example: Block external access to router management interface using iptables
# Apply these rules on an upstream firewall or gateway device

# Block external access to the router's web interface (assuming router IP is 192.168.1.1)
iptables -A FORWARD -d 192.168.1.1 -p tcp --dport 80 -j DROP
iptables -A FORWARD -d 192.168.1.1 -p tcp --dport 443 -j DROP

# Allow only specific trusted management IP
iptables -I FORWARD -s 192.168.1.100 -d 192.168.1.1 -p tcp --dport 80 -j ACCEPT