CVE-2024-8077: Totolink T8 Firmware RCE Vulnerability

CVE-2024-8077 Overview

CVE-2024-8077 is an operating system command injection vulnerability [CWE-78] affecting the TOTOLINK AC1200 T8 router running firmware version 4.1.5cu.862_B20230228. The flaw resides in the setTracerouteCfg function, which fails to sanitize user-supplied input before passing it to a shell context. Attackers can exploit the issue remotely over the network with low privileges and no user interaction. According to VulDB references, the vendor was contacted prior to disclosure but did not respond. No official patch is currently published.

Critical Impact

Authenticated remote attackers can inject arbitrary OS commands through the setTracerouteCfg function, achieving code execution on the router with the privileges of the web management daemon.

Affected Products

• TOTOLINK AC1200 T8 router (hardware)
• TOTOLINK T8 firmware version 4.1.5cu.862_B20230228
• Deployments exposing the router web management interface to untrusted networks

Discovery Timeline

• 2024-08-22 - CVE-2024-8077 published to the National Vulnerability Database
• 2024-12-13 - Last updated in the NVD database

Technical Details for CVE-2024-8077

Vulnerability Analysis

The vulnerability is classified as OS command injection [CWE-78] in the TOTOLINK T8 router firmware. The affected component is the setTracerouteCfg handler exposed by the device web management interface. The handler accepts a parameter intended to configure a traceroute target, then concatenates that value into a shell command without sanitization or argument quoting.

When an attacker supplies shell metacharacters such as ;, &&, or backticks within the request parameters, the underlying shell parses the injected payload as additional commands. Execution proceeds in the context of the router web service, which typically runs with elevated privileges on embedded Linux devices.

The EPSS data places this issue in the 84th percentile, reflecting active interest from researchers and a public proof-of-concept on GitHub. Successful exploitation yields persistent control over the router, enabling DNS tampering, traffic interception, lateral movement into the LAN, and recruitment into botnets targeting consumer networking equipment.

Root Cause

The root cause is improper neutralization of special elements used in an OS command. The setTracerouteCfg function forwards attacker-controlled input directly into a system shell invocation, most likely through system(), popen(), or an equivalent call in the device CGI binary. No allowlist, escaping, or argument-array execution model is applied to the input.

Attack Vector

The attack vector is network-based and requires authenticated access to the router management interface. An attacker on the LAN, or on the WAN if remote administration is exposed, sends a crafted HTTP request to the setTracerouteCfg endpoint with shell metacharacters embedded in the traceroute target parameter. The injected commands execute on the underlying BusyBox shell.

A public proof-of-concept is documented in the GitHub PoC Repository, which also describes a related buffer overflow condition in the same handler. Refer to the advisory for the exact request structure and payload examples.

Detection Methods for CVE-2024-8077

Indicators of Compromise

• Unexpected HTTP POST requests to the router management interface targeting the setTracerouteCfg endpoint with shell metacharacters such as ;, |, &&, or backticks in parameter values.
• New or unknown processes spawned by the router web daemon, including reverse shells, wget/curl invocations, or modifications to /etc/ configuration files.
• Unusual outbound connections from the router to attacker-controlled hosts shortly after a management interface request.

Detection Strategies

• Inspect HTTP traffic to TOTOLINK T8 devices for parameter values that contain shell metacharacters, command separators, or encoded variants targeting setTracerouteCfg.
• Correlate router authentication events with subsequent traceroute configuration changes to surface anomalous administrative behavior.
• Where supported, ingest router syslog into a SIEM and alert on shell command artifacts inside web request logs.

Monitoring Recommendations

• Place network sensors between client subnets and the router management VLAN to capture management-plane HTTP traffic.
• Track DNS resolver and default gateway changes on client devices, which often indicate router compromise.
• Monitor for scanning activity against TCP ports 80 and 443 of internet-exposed TOTOLINK devices, including spikes in failed and successful logins.

How to Mitigate CVE-2024-8077

Immediate Actions Required

• Disable remote (WAN-side) administration on the TOTOLINK T8 and restrict the management interface to a trusted LAN segment.
• Change default and reused administrator credentials, since exploitation requires low-privileged authenticated access.
• Segment the router from sensitive internal assets so that a compromised device cannot pivot into production networks.

Patch Information

No vendor patch is currently listed in NVD references for CVE-2024-8077. VulDB notes in the VulDB #275559 advisory that the vendor was contacted but did not respond. Organizations should monitor the TOTOLink Official Website for firmware updates and consider replacing affected hardware if a fix is not released.

Workarounds

• Block external access to the router HTTP/HTTPS management ports at the upstream firewall or ISP gateway.
• Place the T8 behind an additional firewall and restrict management access to a dedicated administrative host via ACL.
• Replace the AC1200 T8 with a supported router model if the vendor does not publish a firmware fix.

# Example: restrict management interface access on an upstream firewall (iptables)
# Allow management only from a trusted admin host, drop everything else
iptables -A FORWARD -p tcp -s 10.0.0.10 -d 192.168.1.1 --dport 80 -j ACCEPT
iptables -A FORWARD -p tcp -s 10.0.0.10 -d 192.168.1.1 --dport 443 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.168.1.1 --dport 80 -j DROP
iptables -A FORWARD -p tcp -d 192.168.1.1 --dport 443 -j DROP