CVE-2024-0999 Overview
CVE-2024-0999 is a stack-based buffer overflow vulnerability in the Totolink N200RE router running firmware version 9.3.5u.6139_B20201216. The flaw resides in the setParentalRules function within /cgi-bin/cstecgi.cgi. Attackers can trigger the overflow by manipulating the eTime argument in a crafted HTTP request. The issue is classified under [CWE-121: Stack-based Buffer Overflow]. Exploitation can occur remotely over the network and requires only low-level privileges. The vulnerability was tracked in VulDB as identifier VDB-252268 and publicly disclosed with exploit details. According to the disclosure, the vendor was contacted early but did not respond.
Critical Impact
Authenticated remote attackers can corrupt stack memory on affected N200RE devices, potentially achieving arbitrary code execution on the router and full compromise of the network perimeter.
Affected Products
- Totolink N200RE hardware router
- Totolink N200RE firmware version 9.3.5u.6139_B20201216
- Deployments exposing the /cgi-bin/cstecgi.cgi management interface
Discovery Timeline
- 2024-01-29 - CVE-2024-0999 published to NVD with VulDB identifier VDB-252268
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-0999
Vulnerability Analysis
The vulnerability exists in the setParentalRules handler exposed through the Common Gateway Interface (CGI) binary /cgi-bin/cstecgi.cgi on the Totolink N200RE router. When the handler processes the eTime parameter, it copies attacker-controlled data into a fixed-size stack buffer without validating the input length. This unchecked copy overwrites adjacent stack memory, including saved return addresses and frame pointers. An attacker with access to the router's web management interface can supply an oversized eTime value to hijack control flow. Because MIPS-based embedded routers typically lack modern exploit mitigations such as Address Space Layout Randomization (ASLR) and stack canaries, reliable code execution is achievable.
Root Cause
The root cause is missing bounds checking on the eTime argument before it is written into a stack-allocated buffer inside setParentalRules. The function relies on unsafe string handling routines that do not enforce a maximum length matching the destination buffer size. This is a classic instance of [CWE-121: Stack-based Buffer Overflow].
Attack Vector
Exploitation requires network access to the router's HTTP management interface and a valid low-privilege session. The attacker sends a POST request to /cgi-bin/cstecgi.cgi invoking the setParentalRules topic with an overlong eTime value. Successful exploitation yields code execution in the context of the CGI process, which typically runs as root on Totolink devices. See the JYLSEC Vulnerability Report for the disclosed proof-of-concept details.
Detection Methods for CVE-2024-0999
Indicators of Compromise
- HTTP POST requests to /cgi-bin/cstecgi.cgi referencing the setParentalRules topic with unusually long eTime parameter values.
- Unexpected reboots, service crashes, or httpd/CGI process restarts on N200RE routers.
- Outbound connections from the router to unfamiliar hosts, indicating a possible implanted backdoor.
Detection Strategies
- Inspect router web-server logs for malformed or oversized parameters submitted to cstecgi.cgi endpoints.
- Deploy network intrusion detection signatures that match POST bodies containing topicurl=setParentalRules with eTime values exceeding expected time-string lengths.
- Baseline management-plane traffic and alert on non-administrator hosts accessing the router HTTP interface.
Monitoring Recommendations
- Forward router syslog and management-plane telemetry into a centralized SIEM for correlation.
- Monitor for lateral movement originating from the router's LAN interface following suspicious CGI requests.
- Track firmware version inventory to identify unpatched N200RE devices reachable from untrusted networks.
How to Mitigate CVE-2024-0999
Immediate Actions Required
- Restrict access to the router's web management interface to trusted management VLANs only; never expose it to the internet.
- Rotate administrator credentials on all N200RE devices to reduce the risk of low-privileged session abuse.
- Disable the parental controls feature if not required, minimizing the attack surface of the setParentalRules handler.
- Inventory all Totolink N200RE devices running firmware 9.3.5u.6139_B20201216 and prioritize replacement or isolation.
Patch Information
At the time of publication, no vendor patch is available. The disclosure record notes that Totolink was contacted early but did not respond. Organizations should treat affected devices as end-of-support for this vulnerability and plan replacement with a supported platform. Monitor the VulDB entry #252268 for updates.
Workarounds
- Place affected routers behind an upstream firewall that blocks inbound access to TCP ports serving the web UI.
- Enforce access control lists limiting administrative HTTP access to specific management IP addresses.
- Replace the affected N200RE hardware with a currently-supported router platform that receives security updates.
# Example iptables rule to restrict router management access to a single admin host
iptables -A INPUT -p tcp --dport 80 -s 192.0.2.10 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -s 192.0.2.10 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
