CVE-2024-51141 Overview
CVE-2024-51141 affects the TOTOLINK Bluetooth Wireless Adapter A600UB driver installation software. The vulnerability resides in the WifiAutoInstallDriver.exe component and its handling of the MSASN1.dll library. A local attacker can execute arbitrary code by planting a malicious DLL that the installer loads without proper verification. The flaw is classified under [CWE-354]: Improper Validation of Integrity Check Value. Successful exploitation grants code execution in the context of the user running the installer, which is commonly an administrator during driver setup.
Critical Impact
Local attackers can achieve arbitrary code execution by exploiting DLL search order hijacking in the TOTOLINK A600UB driver installer, compromising confidentiality, integrity, and availability.
Affected Products
- TOTOLINK A6000UB Bluetooth Wireless Adapter (hardware)
- TOTOLINK A6000UB Firmware
- WifiAutoInstallDriver.exe driver installation utility
Discovery Timeline
- 2024-11-15 - CVE-2024-51141 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-51141
Vulnerability Analysis
The vulnerability is a DLL hijacking flaw in the TOTOLINK A600UB driver installer. When WifiAutoInstallDriver.exe executes, it attempts to load MSASN1.dll without specifying a fully qualified path. Windows resolves the DLL name using its default search order, which begins with the directory of the executing binary. An attacker who places a malicious MSASN1.dll alongside the installer forces the process to load the attacker-controlled library instead of the legitimate system DLL located in System32.
The installer does not validate the integrity or origin of the DLL before loading. This mapping of untrusted code into a trusted process leads to arbitrary code execution. Because driver installers are frequently launched with elevated privileges, exploitation can result in privilege escalation on the target host.
Root Cause
The root cause is improper validation of an integrity check value on a dynamically loaded library. The installer relies on the Windows loader search path rather than signature verification or absolute path resolution. Any writable location earlier in the search order becomes an attack surface.
Attack Vector
Exploitation requires local access and user interaction. The attacker stages a crafted MSASN1.dll in the same directory as WifiAutoInstallDriver.exe, typically through a download folder, USB media, or social engineering that convinces the victim to run the installer from an attacker-controlled path. When the user launches the installer, the malicious DLL executes with the installer's privileges. See the InfoSec Writeups Analysis for the full technical walkthrough of the exploitation flow.
Detection Methods for CVE-2024-51141
Indicators of Compromise
- Presence of an MSASN1.dll file in the same directory as WifiAutoInstallDriver.exe rather than in %SystemRoot%\System32.
- Unsigned or unusually small MSASN1.dll binaries in user-writable directories such as Downloads, Desktop, or removable media.
- Child processes spawned by WifiAutoInstallDriver.exe that do not match expected driver installation activity.
Detection Strategies
- Monitor process image loads for WifiAutoInstallDriver.exe and alert when MSASN1.dll is loaded from a path outside System32.
- Correlate execution of the installer from non-standard directories with subsequent creation of files, services, or registry Run keys.
- Hunt for known-good hashes of MSASN1.dll and flag mismatches when loaded by the affected installer.
Monitoring Recommendations
- Enable Windows Sysmon Event ID 7 (ImageLoad) for driver installer processes and forward events to a centralized log platform.
- Track user-initiated executions of WifiAutoInstallDriver.exe from writable directories and require review before elevation.
- Baseline expected DLL load paths for driver setup utilities and alert on deviations.
How to Mitigate CVE-2024-51141
Immediate Actions Required
- Restrict execution of WifiAutoInstallDriver.exe to trusted, non-writable directories controlled by administrators.
- Remove or quarantine any MSASN1.dll files found adjacent to the installer that do not match the legitimate Microsoft-signed binary.
- Contact TOTOLINK support to confirm availability of an updated driver package before reinstalling the A600UB adapter.
Patch Information
No vendor advisory or patch URL is listed in the CVE record at this time. Consult the InfoSec Writeups Analysis and the TOTOLINK support portal for updates. Until a fixed installer is released, treat all copies of WifiAutoInstallDriver.exe as potentially exploitable.
Workarounds
- Execute the installer only from a clean, empty directory that no unprivileged user can write to.
- Apply application allow-listing (for example, Windows Defender Application Control or AppLocker) to block loading of unsigned DLLs by the installer.
- Verify the digital signature of MSASN1.dll and other adjacent DLLs before running the installer.
- Uninstall the A600UB driver package on systems where the adapter is not required.
# Verify MSASN1.dll signature before running the installer (PowerShell)
Get-AuthenticodeSignature -FilePath "C:\Path\To\Installer\MSASN1.dll"
# Confirm the legitimate MSASN1.dll resides only in System32
Get-ChildItem -Path C:\ -Recurse -Filter MSASN1.dll -ErrorAction SilentlyContinue |
Select-Object FullName, Length, LastWriteTime
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
