CVE-2024-1002: Totolink N200RE Buffer Overflow Flaw

CVE-2024-1002 Overview

CVE-2024-1002 is a stack-based buffer overflow [CWE-121] in the Totolink N200RE router running firmware version 9.3.5u.6139_B20201216. The flaw resides in the setIpPortFilterRules function within /cgi-bin/cstecgi.cgi. Attackers manipulate the ePort argument to overflow a fixed-size stack buffer. The vulnerability is reachable over the network and requires low-privileged authentication. Public exploit details have been disclosed, increasing the risk of opportunistic attacks. According to the disclosure, the vendor was contacted before publication but did not respond.

Critical Impact
Remote authenticated attackers can corrupt the stack of the router's web management CGI, enabling denial of service and potential arbitrary code execution on the device.

Affected Products

Totolink N200RE hardware
Totolink N200RE firmware 9.3.5u.6139_B20201216
Deployments exposing /cgi-bin/cstecgi.cgi to reachable network segments

Discovery Timeline

2024-01-29 - CVE-2024-1002 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-1002

Vulnerability Analysis

The Totolink N200RE web management interface exposes /cgi-bin/cstecgi.cgi, a CGI binary that dispatches to internal handler functions based on request parameters. The setIpPortFilterRules handler processes user-supplied filter rules including the ePort parameter. The handler copies ePort into a fixed-size stack buffer without validating input length, resulting in a classic stack-based buffer overflow [CWE-121].

Successful exploitation corrupts saved registers and the return address on the stack. On MIPS-based SOHO routers such as the N200RE, this class of overflow commonly leads to control of the program counter and execution of attacker-supplied shellcode. The impact extends to full compromise of the device with the privileges of the CGI process. See the Jylsec Vulnerability Report for the technical write-up.

Root Cause

The underlying defect is missing bounds checking on the ePort argument before it is copied into a stack buffer. The CGI handler trusts client-supplied length without enforcing a maximum size, violating safe string-copy practices in C.

Attack Vector

An attacker sends a crafted HTTP POST request to /cgi-bin/cstecgi.cgi invoking setIpPortFilterRules with an oversized ePort value. The request is delivered over the LAN or, where remote management is enabled, over the WAN. Exploitation requires authenticated access to the web interface but no user interaction.

No verified proof-of-concept code is republished here. Refer to the VulDB entry #252271 for additional exploitation notes.

Detection Methods for CVE-2024-1002

Indicators of Compromise

HTTP POST requests to /cgi-bin/cstecgi.cgi containing the setIpPortFilterRules action with abnormally long ePort values
Unexpected reboots or crashes of the router's cstecgi.cgi process
New administrative sessions, DNS setting changes, or firewall rule modifications on the device following suspicious CGI traffic

Detection Strategies

Inspect web management traffic for parameter values exceeding expected port-string lengths (ports are numeric and short)
Alert on repeated POSTs to /cgi-bin/cstecgi.cgi from a single source within short time windows
Correlate CGI request anomalies with device availability changes to identify overflow attempts

Monitoring Recommendations

Log all HTTP requests reaching router management interfaces via an upstream network sensor or gateway
Forward router syslog to a central log platform and monitor for repeated CGI faults
Track the router firmware version inventory and flag hosts still running 9.3.5u.6139_B20201216

How to Mitigate CVE-2024-1002

Immediate Actions Required

Restrict access to the router web interface to trusted management VLANs and disable WAN-side administration
Enforce strong administrative credentials and rotate any passwords currently in use
Segment the N200RE from sensitive internal networks until a fixed firmware is available

Patch Information

No vendor patch has been published at the time of NVD entry update. The disclosure notes that Totolink was contacted early but did not respond. Monitor the Totolink support portal for firmware updates addressing setIpPortFilterRules and replace the device if it remains unpatched.

Workarounds

Disable remote (WAN) management on the N200RE administrative interface
Place the router behind an upstream firewall that blocks untrusted access to TCP management ports
Filter or drop HTTP requests targeting /cgi-bin/cstecgi.cgi from non-management hosts using an inline security appliance
Consider replacing end-of-support consumer routers with actively maintained models when the vendor does not deliver patches

bash

# Example iptables rule to restrict router admin interface to a management subnet
iptables -A INPUT -p tcp --dport 80 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP