CVE-2024-7214: Totolink LR350 Firmware RCE Vulnerability

CVE-2024-7214 Overview

CVE-2024-7214 is a command injection vulnerability in the TOTOLINK LR350 router running firmware version 9.3.5u.6369_B20220309. The flaw resides in the setWanCfg function within /cgi-bin/cstecgi.cgi. Attackers can manipulate the hostName argument to inject arbitrary operating system commands. The vulnerability is exploitable remotely over the network and requires low privileges. Public exploit details have been disclosed via VulDB entry VDB-272785. The vendor was contacted about this disclosure but did not respond, leaving affected devices without an official patch. The vulnerability maps to [CWE-77] Improper Neutralization of Special Elements used in a Command.

Critical Impact
Authenticated remote attackers can execute arbitrary commands on affected TOTOLINK LR350 routers by injecting shell metacharacters into the hostName parameter of the WAN configuration endpoint.

Affected Products

TOTOLINK LR350 hardware router
TOTOLINK LR350 firmware version 9.3.5u.6369_B20220309
Deployments exposing the /cgi-bin/cstecgi.cgi interface to untrusted networks

Discovery Timeline

2024-07-30 - CVE-2024-7214 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-7214

Vulnerability Analysis

The TOTOLINK LR350 web management interface exposes the cstecgi.cgi binary to handle configuration requests. The setWanCfg handler processes the hostName argument submitted in a WAN configuration request. The handler passes this attacker-controlled string into a shell command without adequate neutralization of metacharacters such as ;, |, &, or backticks. Because the CGI process typically runs as root on embedded routers, injected commands execute with the highest privileges on the device. An attacker with valid low-privilege credentials or access to a poorly protected admin interface can leverage this to achieve full compromise of the router. Post-exploitation activity commonly includes persistence, DNS hijacking, traffic interception, and enrollment in botnets targeting embedded Linux devices.

Root Cause

The root cause is improper neutralization of special elements in an OS command [CWE-77]. The setWanCfg function accepts the hostName parameter as user-supplied input and concatenates it into a system-level command invocation. No input allow-listing, escaping, or safe-execution API is used. Any shell metacharacter appended to the parameter is interpreted by the underlying shell.

Attack Vector

The attack vector is network-based. An authenticated attacker sends a crafted HTTP POST request to /cgi-bin/cstecgi.cgi invoking the setWanCfg topic and supplying a malicious hostName value. The injected payload is executed by the router's shell during WAN configuration processing. No user interaction is required beyond authentication to the router's web interface. See the GitHub IoT Configuration Vulnerability writeup and VulDB #272785 for the disclosed technical description.

// No verified proof-of-concept code is republished here.
// See the linked VulDB and GitHub references for disclosed technical details.

Detection Methods for CVE-2024-7214

Indicators of Compromise

HTTP POST requests to /cgi-bin/cstecgi.cgi containing the setWanCfg topic combined with shell metacharacters (;, |, &, `, $() in the hostName field.
Unexpected outbound connections from the router to unknown IP addresses shortly after WAN configuration changes.
Unauthorized modifications to DNS server settings, firewall rules, or administrative credentials on the LR350.

Detection Strategies

Inspect HTTP request bodies destined for the router's management interface for non-hostname characters within the hostName parameter.
Deploy network intrusion detection signatures that flag command-injection patterns in cstecgi.cgi traffic.
Correlate configuration change events on the router with subsequent anomalous outbound traffic or DNS query patterns.

Monitoring Recommendations

Log and review all authenticated sessions to the LR350 management interface, especially from non-administrative subnets.
Monitor for firmware or configuration files being fetched from external hosts by the router.
Alert on repeated failed and successful logins to the router's web UI that precede WAN configuration requests.

How to Mitigate CVE-2024-7214

Immediate Actions Required

Remove the LR350 management interface from any WAN-facing exposure and restrict it to a dedicated management VLAN.
Rotate all administrative credentials on affected devices and disable unused accounts.
Segment the router from sensitive internal assets until a vendor patch becomes available.

Patch Information

At the time of publication, TOTOLINK has not released a security advisory or firmware update addressing CVE-2024-7214. The vendor did not respond to disclosure attempts, according to VulDB. Administrators should monitor the TOTOLINK support portal for future firmware releases and treat the device as unpatched until an updated build is published.

Workarounds

Disable remote management on the WAN interface and permit administration only from trusted LAN hosts.
Place the router behind an upstream firewall that blocks unsolicited inbound access to TCP ports serving the web UI.
Consider replacing the LR350 with a supported device if the vendor does not issue a firmware fix.

bash

# Example: restrict access to the LR350 management interface using an upstream firewall
# Replace 192.0.2.10 with the trusted admin workstation and 10.0.0.1 with the router IP
iptables -A FORWARD -s 192.0.2.10 -d 10.0.0.1 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -d 10.0.0.1 -p tcp --dport 80 -j DROP
iptables -A FORWARD -d 10.0.0.1 -p tcp --dport 443 -j DROP