CVE-2023-36955 in CP300+
Summary
by MITRE • 10/25/2023
TOTOLINK CP300+ <=V5.2cu.7594_B20200910 was discovered to contain a stack overflow via the File parameter in the function UploadCustomModule.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 01/15/2026
The vulnerability identified as CVE-2023-36955 affects TOTOLINK CP300+ routers running firmware versions up to and including V5.2cu.7594_B20200910. This represents a critical security flaw that stems from improper input validation within the device's web interface handling mechanism. The vulnerability manifests specifically within the UploadCustomModule function where the File parameter is processed without adequate bounds checking or sanitization measures.
The technical exploitation of this vulnerability occurs through a stack overflow condition that arises when an attacker supplies a maliciously crafted file parameter during the upload process. This flaw falls under the CWE-121 category of Stack-based Buffer Overflow, where the function fails to properly validate the length of input data before copying it to a fixed-size buffer on the stack. The lack of proper input validation creates an opportunity for attackers to overwrite adjacent stack memory locations, potentially leading to arbitrary code execution or system crashes.
From an operational perspective, this vulnerability presents significant risks to network security as it allows remote attackers to gain unauthorized control over affected devices. The attack surface is particularly concerning because it does not require authentication, making it accessible to anyone who can reach the device's web interface. This vulnerability can be exploited to execute malicious code on the router, potentially enabling attackers to establish persistent access points, redirect network traffic, or use the device as a launching point for attacks against other network resources. The impact extends beyond individual device compromise to potentially affect entire network infrastructures that rely on these devices for connectivity and security.
The exploitation of this vulnerability aligns with ATT&CK technique T1059.007 for Command and Scripting Interpreter, where attackers can execute arbitrary commands on the compromised device. Network security professionals should consider implementing network segmentation and monitoring for unusual upload activities or file transfers to detect potential exploitation attempts. Organizations should prioritize immediate firmware updates from TOTOLINK to address this vulnerability, as no reliable workarounds exist for this specific flaw. The vulnerability also highlights the importance of input validation practices in embedded systems and web applications, particularly when handling file uploads where buffer size limitations must be strictly enforced to prevent memory corruption attacks.