Totolink LR1200GB 9.1.0u.6619_B20230130/9.3.5u.6698_B20230810 Web Interface /cgi-bin/cstecgi.cgi loginAuth http_host stack-based overflow

CVSS Meta Temp Score
CVSS is a standardized scoring system to determine possibilities of attacks. The Temp Score considers temporal factors like disclosure, exploit and countermeasures. The unique Meta Score calculates the average score of different sources to provide a normalized scoring system.
Current Exploit Price (≈)
Our analysts are monitoring exploit markets and are in contact with vulnerability brokers. The range indicates the observed or calculated exploit price to be seen on exploit markets. A good indicator to understand the monetary effort required for and the popularity of an attack.
CTI Interest Score
Our Cyber Threat Intelligence team is monitoring different web sites, mailing lists, exploit markets and social media networks. The CTI Interest Score identifies the interest of attackers and the security community for this specific vulnerability in real-time. A high score indicates an elevated risk to be targeted for this vulnerability.
9.3$0-$5k0.03

Overview

A vulnerability classified as critical has been found in Totolink LR1200GB 9.1.0u.6619_B20230130/9.3.5u.6698_B20230810. Affected is the function loginAuth of the file /cgi-bin/cstecgi.cgi of the component Web Interface. The manipulation of the argument http_host leads to stack-based buffer overflow. Using CWE to declare the problem leads to CWE-121. The weakness was shared 02/22/2024. The advisory is available at gist.github.com. This vulnerability is traded as CVE-2024-1783. It is possible to launch the attack remotely. Technical details are available. Furthermore, there is an exploit available. The exploit has been disclosed to the public and may be used. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment. It is declared as proof-of-concept. The exploit is shared for download at gist.github.com. As 0-day the estimated underground price was around $0-$5k. The vendor was contacted early about this disclosure but did not respond in any way. A possible mitigation has been published before and not just after the disclosure of the vulnerability. [Details]

IOB - Indicator of Behavior (1317)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en1208
fr32
ja16
zh14
de12

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Country

us224
gb118
de46
cn30
fr26

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Actors

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Activities

IOC - Indicator of Compromise (57)

These indicators of compromise highlight associated network ranges which are known to be part of research and attack activities.

IDIP rangeActorTypeConfidence
13.67.84.0/24SliverpredictiveHigh
23.71.181.0/24SliverpredictiveHigh
35.135.8.0/24PonypredictiveHigh
413.58.77.0/24StantinkopredictiveHigh
515.181.199.0/24QakBotpredictiveHigh
623.19.226.0/24APT34predictiveHigh
7XX.XXX.XXX.X/XXXxxxxxxxxxpredictiveHigh
8XX.XXX.XX.X/XXXxxxxpredictiveHigh
9XX.XX.XXX.X/XXXxxxxx XxxpredictiveHigh
10XX.XX.XXX.X/XXXxxxxx XxxxxxpredictiveHigh
11XX.XX.XXX.X/XXXxxxxxxxpredictiveHigh
12XX.XXX.XXX.X/XXXxxxxxxpredictiveHigh
13XX.XXX.XX.X/XXXxxxxx XxxxxxpredictiveHigh
14XX.XXX.XXX.X/XXXxxxxxpredictiveHigh
15XX.XXX.XX.X/XXXxxxxpredictiveHigh
16XX.XXX.XX.X/XXXxxxxpredictiveHigh
17XX.XXX.XX.X/XXXxxxxx XxxxxxpredictiveHigh
18XX.XXX.XXX.X/XXXxxxxxpredictiveHigh
19XX.XX.XXX.X/XXXxxxxxxxpredictiveHigh
20XX.XXX.XXX.X/XXXxxxxxxxpredictiveHigh
21XX.XX.XXX.X/XXXxxxxxxpredictiveHigh
22XX.XX.X.X/XXXxxxxxxxpredictiveHigh
23XX.XX.XX.X/XXXxxxxxx XxxpredictiveHigh
24XX.XXX.XXX.X/XXXxxxxxpredictiveHigh
25XX.XXX.XX.X/XXXxxxxx XxxxxxpredictiveHigh
26XX.XXX.XXX.X/XXXxxxxxxxxxpredictiveHigh
27XX.XXX.XXX.X/XXXxxxxxxpredictiveHigh
28XX.XXX.XXX.X/XXXxxxxxx XxxxxxxpredictiveHigh
29XX.XX.XXX.X/XXXxxxxxxxxxpredictiveHigh
30XXX.XX.XX.X/XXXxxxxxpredictiveHigh
31XXX.XX.XX.X/XXXxxxxxxxpredictiveHigh
32XXX.XXX.XXX.X/XXXxxxxx XxxxxxpredictiveHigh
33XXX.XX.XXX.X/XXXxxxxx XxxxxxpredictiveHigh
34XXX.XXX.XX.X/XXXxxxxxpredictiveHigh
35XXX.XXX.XXX.X/XXXxxxxx XxxxxxpredictiveHigh
36XXX.XX.XXX.X/XXXxxxxpredictiveHigh
37XXX.XX.XXX.X/XXXxxxxxxxpredictiveHigh
38XXX.XX.XXX.X/XXXxxxxxpredictiveHigh
39XXX.XXX.XXX.X/XXXxxxxxxpredictiveHigh
40XXX.XXX.XXX.X/XXXxxxxxxxxxxxpredictiveHigh
41XXX.XX.XX.X/XXXxxxxxxpredictiveHigh
42XXX.XXX.XX.X/XXXxxxxx XxxxxxpredictiveHigh
43XXX.XX.XXX.X/XXXxxxxxxpredictiveHigh
44XXX.XXX.XXX.X/XXXxxxpredictiveHigh
45XXX.XXX.XXX.X/XXXxxxxx XxxpredictiveHigh
46XXX.XX.XXX.X/XXXxxxxxpredictiveHigh
47XXX.XX.XXX.X/XXXxxxxxpredictiveHigh
48XXX.XXX.XXX.X/XXXxxxxxx XxxxxxpredictiveHigh
49XXX.XX.XXX.X/XXXxxxxxxxpredictiveHigh
50XXX.XXX.XXX.X/XXXxxxpredictiveHigh
51XXX.XXX.XXX.X/XXXxxxx XxxxxxxpredictiveHigh
52XXX.XXX.XXX.X/XXXxxxxxxxpredictiveHigh
53XXX.XX.XXX.X/XXXxxxxpredictiveHigh
54XXX.XXX.XXX.X/XXXxxxxxxpredictiveHigh
55XXX.XXX.XX.X/XXXxxxxxxxpredictiveHigh
56XXX.XX.XX.X/XXXxxxxxpredictiveHigh
57XXX.XX.XX.X/XXXxxxxpredictiveHigh

IOA - Indicator of Attack (2)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

IDClassIndicatorTypeConfidence
1File/cgi-bin/cstecgi.cgiverifiedHigh
2Argumentxxxx_xxxxverifiedMedium

Do you know our Splunk app?

Download it now for free!