CVE-2024-0997: Totolink N200RE Buffer Overflow Vulnerability

CVE-2024-0997 Overview

CVE-2024-0997 is a stack-based buffer overflow vulnerability [CWE-121] in the Totolink N200RE router running firmware version 9.3.5u.6139_B20201216. The flaw resides in the setOpModeCfg function within /cgi-bin/cstecgi.cgi. Manipulating the pppoeUser argument triggers the overflow. The attack is exploitable remotely and requires low privileges. The exploit has been publicly disclosed, and the vendor did not respond to disclosure attempts.

Critical Impact
Remote attackers with low-privilege access can trigger a stack buffer overflow through the pppoeUser parameter, potentially leading to arbitrary code execution or denial of service on affected N200RE routers.

Affected Products

Totolink N200RE hardware router
Totolink N200RE firmware version 9.3.5u.6139_B20201216
Deployments exposing the cstecgi.cgi management endpoint

Discovery Timeline

2024-01-29 - CVE-2024-0997 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-0997

Vulnerability Analysis

The vulnerability is a classic stack-based buffer overflow in the router's web management CGI binary. The setOpModeCfg handler in /cgi-bin/cstecgi.cgi processes operating-mode configuration requests that include the pppoeUser field. The function copies attacker-controlled input into a fixed-size stack buffer without proper length validation. An authenticated remote attacker can supply an oversized pppoeUser value to corrupt adjacent stack memory, including the saved return address.

Because the target is an embedded MIPS-based router with limited exploit mitigations, successful memory corruption can redirect execution flow. Consequences range from crashing the CGI process and denying management access to executing attacker-supplied shellcode with the privileges of the web server.

Root Cause

The root cause is missing bounds checking on the pppoeUser argument before it is copied into a stack-allocated buffer inside setOpModeCfg. The firmware relies on unsafe string handling routines without validating the length of user-supplied HTTP parameters received by cstecgi.cgi.

Attack Vector

Exploitation occurs over the network against the router's HTTP management interface. The attacker sends a crafted HTTP request to /cgi-bin/cstecgi.cgi invoking the setOpModeCfg action with an oversized pppoeUser value. Low-privilege authenticated access to the web interface is required. When the management interface is exposed to untrusted networks or the internet, the attack surface expands significantly.

Refer to the JYLSEC Vulnerability Report and VulDB entry #252266 for further technical detail.

Detection Methods for CVE-2024-0997

Indicators of Compromise

HTTP POST requests to /cgi-bin/cstecgi.cgi containing abnormally long pppoeUser parameter values.
Repeated crashes or restarts of the router's cstecgi.cgi process or web management daemon.
Unexpected configuration changes to PPPoE or operating-mode settings on N200RE devices.
Outbound connections from the router to unfamiliar hosts following a suspicious management request.

Detection Strategies

Inspect HTTP traffic destined for the router management interface for oversized parameter values, particularly in setOpModeCfg requests.
Correlate authentication events on the router with subsequent management-plane traffic to identify low-privilege accounts abusing the CGI endpoint.
Alert on router availability changes or repeated reboots that coincide with inbound HTTP traffic to cstecgi.cgi.

Monitoring Recommendations

Log and forward router administrative access and syslog events to a centralized SIEM for analysis.
Monitor perimeter firewall logs for external sources attempting to reach the router's management port.
Track firmware version inventory to identify N200RE devices still running 9.3.5u.6139_B20201216.

How to Mitigate CVE-2024-0997

Immediate Actions Required

Restrict access to the N200RE web management interface to trusted management VLANs only; block WAN-side administration.
Rotate all router administrative credentials and remove unused low-privilege accounts that could be abused to reach setOpModeCfg.
Segment vulnerable N200RE routers from sensitive internal networks until a fix is applied or the device is replaced.
Consider replacing the device if the vendor continues to withhold a patch, since the vendor did not respond to the original disclosure.

Patch Information

At the time of publication, Totolink has not issued a security advisory or firmware update addressing CVE-2024-0997. The CVE description explicitly notes that the vendor did not respond to disclosure attempts. Administrators should monitor the Totolink support site for future firmware releases and apply any published update for the N200RE promptly.

Workarounds

Disable remote (WAN) administration on the router and restrict management access to a dedicated wired LAN interface.
Place the router behind an upstream firewall that filters HTTP requests to /cgi-bin/cstecgi.cgi from untrusted sources.
Enforce strong, unique credentials on all router accounts to reduce the risk of low-privilege authenticated abuse.
Where feasible, replace the affected N200RE with a supported device that receives regular security updates.

bash

# Example: block external access to the router management interface at an upstream firewall
# Replace ROUTER_IP with the N200RE LAN/WAN address and MGMT_NET with your trusted management subnet
iptables -A FORWARD -p tcp -d ROUTER_IP --dport 80 -s MGMT_NET -j ACCEPT
iptables -A FORWARD -p tcp -d ROUTER_IP --dport 80 -j DROP
iptables -A FORWARD -p tcp -d ROUTER_IP --dport 443 -s MGMT_NET -j ACCEPT
iptables -A FORWARD -p tcp -d ROUTER_IP --dport 443 -j DROP