Skip to main content
OneCon26: Gain the advantage in the AI era. Oct. 20–22 in Las Vegas.Register Now
Vulnerability Database/CVE-2024-0575

CVE-2024-0575: Totolink LR1200GB Buffer Overflow Flaw

CVE-2024-0575 is a critical stack-based buffer overflow in Totolink LR1200GB firmware affecting the setTracerouteCfg function. Attackers can exploit this remotely to compromise devices. This article covers technical details, affected versions, impact, and mitigation strategies.

Updated:

CVE-2024-0575 Overview

CVE-2024-0575 is a stack-based buffer overflow [CWE-121] in the Totolink LR1200GB router running firmware version 9.1.0u.6619_B20230130. The flaw resides in the setTracerouteCfg function within /cgi-bin/cstecgi.cgi. Attackers can manipulate the command argument to overflow a fixed-size stack buffer. The vulnerability is exploitable remotely without authentication or user interaction. The exploit details have been publicly disclosed, and the vendor did not respond to disclosure attempts.

Critical Impact

Unauthenticated remote attackers can corrupt the stack of the router's web management binary, enabling denial of service or arbitrary code execution on the device.

Affected Products

  • Totolink LR1200GB hardware appliance
  • Totolink LR1200GB firmware version 9.1.0u.6619_B20230130
  • Deployments exposing /cgi-bin/cstecgi.cgi to untrusted networks

Discovery Timeline

  • 2024-01-16 - CVE-2024-0575 published to NVD
  • 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-0575

Vulnerability Analysis

The vulnerability exists in the setTracerouteCfg handler implemented in the CGI binary /cgi-bin/cstecgi.cgi. This handler processes traceroute configuration requests submitted through the router's web management interface. The function reads the user-supplied command parameter and copies it into a fixed-size stack buffer without enforcing a length check. An attacker who sends a crafted HTTP request with an oversized command value overflows the buffer and overwrites adjacent stack data, including the saved return address.

Because the CGI process typically runs with elevated privileges on embedded routers, successful exploitation can yield full control over the device. The attack requires no credentials and no user interaction, so any reachable management interface presents direct exposure.

Root Cause

The root cause is missing bounds validation on the command parameter prior to a stack copy operation, classified under [CWE-121] Stack-Based Buffer Overflow. The handler trusts the length of attacker-controlled input from the HTTP request body.

Attack Vector

Exploitation is performed over the network by issuing a POST request to /cgi-bin/cstecgi.cgi targeting the setTracerouteCfg topic with an overlong command field. Routers that expose the web administration interface to the WAN are reachable directly from the internet. Devices restricted to LAN management remain exploitable from any compromised host on the local network. Technical proof-of-concept details are available in the public VulDB advisory and the GitHub vulnerability writeup.

Detection Methods for CVE-2024-0575

Indicators of Compromise

  • HTTP POST requests to /cgi-bin/cstecgi.cgi containing the setTracerouteCfg topic with abnormally long command parameter values
  • Unexpected restarts or crashes of the router's web administration daemon
  • Outbound connections from the router to unfamiliar hosts following management-interface traffic
  • New or modified firewall, DNS, or routing configuration entries that were not made by administrators

Detection Strategies

  • Inspect web access logs and network captures for requests to cstecgi.cgi carrying command arguments exceeding expected lengths
  • Alert on management-plane HTTP requests originating from WAN-side or otherwise unexpected source addresses
  • Baseline normal traceroute configuration payloads and flag deviations in size or content

Monitoring Recommendations

  • Forward router syslog and HTTP access logs to a centralized log platform for retention and correlation
  • Monitor for DNS resolution changes, new outbound connections, and unusual traffic volumes from the router itself
  • Track firmware version inventory to identify devices still running 9.1.0u.6619_B20230130

How to Mitigate CVE-2024-0575

Immediate Actions Required

  • Restrict access to /cgi-bin/cstecgi.cgi so only trusted management hosts can reach the web administration interface
  • Disable WAN-side administration and any remote management features on affected LR1200GB devices
  • Place vulnerable routers behind an upstream firewall and block inbound HTTP/HTTPS to the device
  • Rotate administrator credentials and audit configuration for unauthorized changes

Patch Information

No vendor patch is available. According to the NVD entry, Totolink was contacted prior to public disclosure but did not respond. Operators should track the vendor support site for future firmware releases and consider replacing the device if no fix is published.

Workarounds

  • Segment affected routers onto a dedicated management VLAN with strict access control lists
  • Block inbound traffic to TCP ports 80 and 443 on the router's WAN interface at the upstream gateway
  • Replace LR1200GB devices in high-risk deployments with hardware that receives active security maintenance
bash
# Example upstream ACL blocking WAN-side access to the router's web UI
iptables -I FORWARD -p tcp -d <router_wan_ip> --dport 80 -j DROP
iptables -I FORWARD -p tcp -d <router_wan_ip> --dport 443 -j DROP

Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

Experience the Most Advanced Cybersecurity Platform

See how the world’s most intelligent, autonomous cybersecurity platform can protect your organization today and into the future.

Try SentinelOne