CVE-2024-0576 Overview
CVE-2024-0576 is a stack-based buffer overflow vulnerability in the Totolink LR1200GB router running firmware version 9.1.0u.6619_B20230130. The flaw resides in the setIpPortFilterRules function within /cgi-bin/cstecgi.cgi. Attackers manipulate the sPort argument to trigger memory corruption on the stack. The vulnerability is exploitable remotely over the network without authentication or user interaction. Public disclosure occurred through VulDB entry VDB-250792, and the vendor did not respond to disclosure attempts. The weakness is classified under [CWE-121] (Stack-based Buffer Overflow).
Critical Impact
Unauthenticated remote attackers can trigger memory corruption in the router's web management CGI, potentially leading to arbitrary code execution and full device compromise.
Affected Products
- Totolink LR1200GB router (hardware)
- Totolink LR1200GB firmware version 9.1.0u.6619_B20230130
- Deployments exposing /cgi-bin/cstecgi.cgi to untrusted networks
Discovery Timeline
- 2024-01-16 - CVE-2024-0576 published to NVD
- 2024-11-21 - Last updated in NVD database
Technical Details for CVE-2024-0576
Vulnerability Analysis
The vulnerability resides in the setIpPortFilterRules handler exposed through the cstecgi.cgi binary in the Totolink LR1200GB web management interface. The handler processes IP and port filtering rules submitted by users. The sPort parameter passes from an HTTP request into a fixed-size stack buffer without proper length validation. Submitting an oversized sPort value overruns the buffer and overwrites adjacent stack memory, including saved return addresses.
MIPS-based embedded routers like the LR1200GB typically run without modern exploit mitigations such as ASLR or stack canaries. This makes return-address overwrites a reliable path to control flow hijacking. Attackers can leverage the corruption to execute arbitrary code with the privileges of the CGI process, which usually runs as root on consumer routers.
Root Cause
The root cause is missing bounds checking on attacker-controlled input copied into a stack-allocated buffer inside setIpPortFilterRules. The function trusts the length of the sPort argument supplied via the CGI request, classifying the issue as [CWE-121].
Attack Vector
The attack vector is network-based and requires no authentication. An attacker sends a crafted HTTP request to /cgi-bin/cstecgi.cgi with an oversized sPort parameter targeting the setIpPortFilterRules function. The exploit has been publicly disclosed through VulDB. Devices exposing the management interface to the internet or to untrusted LAN segments are directly reachable.
The vulnerability is described in prose only because no verified public proof-of-concept code is referenced in the enriched data. Technical details are available in the VulDB #250792 entry and the GitHub research notes.
Detection Methods for CVE-2024-0576
Indicators of Compromise
- HTTP POST requests to /cgi-bin/cstecgi.cgi containing abnormally long sPort parameter values
- Unexpected crashes or reboots of the LR1200GB device's web management daemon
- Outbound connections from the router to unfamiliar IP addresses following inbound CGI traffic
- New or modified firewall rules on the router that were not administrator-initiated
Detection Strategies
- Inspect web server and reverse proxy logs for requests to cstecgi.cgi referencing the setIpPortFilterRules action with oversized parameter values
- Deploy network intrusion detection signatures that flag HTTP request bodies exceeding expected lengths for known router CGI endpoints
- Baseline normal management traffic to the router and alert on anomalous request sizes or unusual source addresses
Monitoring Recommendations
- Forward router syslog and management traffic to a centralized logging platform for retention and analysis
- Monitor for repeated 5xx responses or process crashes from the embedded HTTP daemon
- Track DNS and outbound connection telemetry from network segments where the router resides to identify post-exploitation activity
How to Mitigate CVE-2024-0576
Immediate Actions Required
- Restrict access to the LR1200GB web management interface to trusted internal hosts only and block WAN-side administration
- Place affected routers behind a segmented management VLAN with strict access control lists
- Disable the IP/port filter configuration feature if it is not in active use
- Inventory all Totolink LR1200GB devices in the environment and confirm firmware version
Patch Information
The vendor was contacted prior to disclosure but did not respond, and no official patch is referenced in the available CVE data. Organizations should monitor the Totolink support site for future firmware updates addressing firmware version 9.1.0u.6619_B20230130. In the absence of a vendor patch, consider replacing affected devices with supported hardware from vendors with active security maintenance.
Workarounds
- Block external access to TCP ports hosting the router's web management interface at the perimeter firewall
- Apply source-IP allowlists on the router itself, limiting management to specific administrator workstations
- Terminate management sessions over a VPN rather than direct exposure of the CGI interface
- Replace the device with a maintained alternative if no firmware fix becomes available
# Example iptables rules to restrict access to the management interface
iptables -A INPUT -p tcp --dport 80 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
