CVE-2024-7214: Totolink LR350 Firmware RCE Vulnerability

CVE-2024-7214 Overview

CVE-2024-7214 is a command injection vulnerability in the TOTOLINK LR350 router running firmware version 9.3.5u.6369_B20220309. The flaw resides in the setWanCfg function of /cgi-bin/cstecgi.cgi. Attackers can manipulate the hostName argument to inject arbitrary operating system commands. The vulnerability is remotely exploitable and requires low-level authentication. Public exploit details have been disclosed, and the vendor did not respond to disclosure attempts. The issue is tracked as VDB-272785 and is classified under [CWE-77].

Critical Impact
Remote attackers with low-privileged access can inject arbitrary commands into the router's operating system through the hostName parameter, leading to full device compromise.

Affected Products

TOTOLINK LR350 router hardware
TOTOLINK LR350 firmware version 9.3.5u.6369_B20220309
CPE: cpe:2.3:o:totolink:lr350_firmware:9.3.5u.6369_b20220309

Discovery Timeline

2024-07-30 - CVE-2024-7214 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-7214

Vulnerability Analysis

The vulnerability exists in the setWanCfg handler exposed through the CGI binary /cgi-bin/cstecgi.cgi. The handler processes WAN configuration requests submitted by users of the device's web management interface. The hostName parameter passed to setWanCfg is not sanitized before being incorporated into a shell command executed by the device firmware.

An attacker who reaches the router's management interface can supply shell metacharacters within the hostName field. The injected payload executes with the privileges of the CGI process, typically root on embedded Linux routers. The EPSS score of 3.152% (86.665 percentile) reflects meaningful attacker interest in this class of TOTOLINK vulnerabilities.

Root Cause

The root cause is improper neutralization of special elements used in an OS command [CWE-77]. The setWanCfg function concatenates user-supplied input directly into a system-level command string. No allowlist validation or shell escaping is applied to the hostName argument before invocation.

Attack Vector

The attack vector is network-based. An adversary sends a crafted HTTP POST request to /cgi-bin/cstecgi.cgi targeting the setWanCfg topicurl with a malicious hostName value. Successful exploitation grants command execution on the router, enabling persistent implants, DNS hijacking, or lateral movement into internal networks. Public exploitation guidance is available in the referenced GitHub Configuration Exploit Guide.

Detection Methods for CVE-2024-7214

Indicators of Compromise

Unexpected HTTP POST requests to /cgi-bin/cstecgi.cgi containing topicurl=setWanCfg with shell metacharacters (;, |, `, $()) in the hostName field.
Outbound connections from the router to unfamiliar hosts, indicative of reverse shells or downloader activity.
Unauthorized changes to WAN configuration or DNS settings on the LR350 device.

Detection Strategies

Inspect web-server and CGI logs on the router for requests to setWanCfg with abnormal hostName characters.
Deploy network intrusion detection signatures matching command-injection patterns targeting TOTOLINK cstecgi.cgi endpoints.
Correlate anomalous DNS or firmware update traffic originating from LR350 devices with authentication events on the admin interface.

Monitoring Recommendations

Baseline normal administrative traffic to the LR350 and alert on off-hours requests to /cgi-bin/cstecgi.cgi.
Monitor upstream traffic for command-and-control indicators associated with common IoT botnets that target TOTOLINK devices.
Enable syslog forwarding from the router to a centralized SIEM for retention and correlation.

How to Mitigate CVE-2024-7214

Immediate Actions Required

Remove the LR350 from any internet-exposed position and place it behind a firewall that restricts management access.
Restrict access to the router's web interface to trusted management VLANs and administrative hosts only.
Rotate administrative credentials on the LR350 to invalidate any that may have been captured.
Inspect the device for signs of compromise, including modified startup scripts, unknown processes, and altered DNS entries.

Patch Information

No vendor patch is available. TOTOLINK did not respond to the disclosure, according to the VulDB report. Users should consider replacing the LR350 with a supported device or continuously monitoring the affected unit until firmware guidance is released.

Workarounds

Disable remote WAN-side administration on the LR350 to block unauthenticated network reachability.
Enforce strong, unique administrator passwords and consider IP-based access lists for the management interface.
Segment the router onto an isolated network so a compromised device cannot pivot into sensitive internal systems.
Consider replacement with an actively maintained router platform given the absence of vendor response.

bash

# Example: block external access to the router management interface at the perimeter
iptables -A FORWARD -p tcp -d <LR350_IP> --dport 80 -j DROP
iptables -A FORWARD -p tcp -d <LR350_IP> --dport 443 -j DROP