CVE-2024-0578 in LR1200GB
Summary
by MITRE • 01/16/2024
A vulnerability classified as critical has been found in Totolink LR1200GB 9.1.0u.6619_B20230130. Affected is the function UploadCustomModule of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument File leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-250794 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 02/03/2024
The vulnerability identified as CVE-2024-0578 represents a critical stack-based buffer overflow flaw within the Totolink LR1200GB router firmware version 9.1.0u.6619_B20230130. This issue resides in the UploadCustomModule function of the /cgi-bin/cstecgi.cgi file, which serves as a critical interface for firmware management and system configuration. The vulnerability manifests when processing the File argument, creating an exploitable condition that allows attackers to manipulate memory layout through improper input validation. The stack-based nature of this buffer overflow means that malicious input can overwrite adjacent memory locations on the program stack, potentially leading to arbitrary code execution or system compromise. The affected device operates with elevated privileges through its web management interface, making this vulnerability particularly dangerous as it can be exploited without requiring local access or authentication.
Remote exploitation capabilities make this vulnerability especially concerning for networked environments, as attackers can leverage the web-based management interface to deliver malicious payloads without physical access to the device. The vulnerability affects the router's firmware upload mechanism, which is commonly used for legitimate system updates and custom module installations. The disclosed exploit demonstrates that attackers can craft malicious input to overflow the buffer and overwrite return addresses or other critical stack data, potentially allowing for complete system takeover. This attack vector represents a significant threat to network security infrastructure, as routers serve as fundamental network components that often lack proper input sanitization and memory protection mechanisms.
The technical implications of this vulnerability extend beyond simple code execution, as it can enable attackers to establish persistent backdoors, modify network configurations, or redirect traffic through the compromised device. The absence of vendor response following early disclosure indicates a potential lack of security maintenance for this device, leaving users vulnerable to exploitation. This vulnerability aligns with CWE-121 stack-based buffer overflow classification and represents a direct threat to the integrity of network infrastructure, particularly when considering the ATT&CK framework's T1059.007 technique for command and scripting interpreter execution. The exploitation of this flaw could enable attackers to perform reconnaissance, establish command and control channels, or conduct man-in-the-middle attacks against network traffic passing through the compromised router.
Mitigation strategies should prioritize immediate firmware updates from the vendor if available, though the lack of vendor response suggests this may not be feasible for affected users. Network segmentation and firewall rules should be implemented to restrict access to the router's management interfaces, particularly limiting access to trusted networks only. Monitoring for unusual traffic patterns or unauthorized firmware uploads can help detect exploitation attempts. Security teams should also consider implementing intrusion detection systems that can identify malicious payloads targeting this specific vulnerability. Device hardening practices including disabling unnecessary services, implementing strong authentication mechanisms, and regular security audits should be enforced to reduce overall risk exposure. Organizations should also maintain detailed network asset inventories to quickly identify and isolate affected devices, as the vulnerability affects a common consumer-grade networking device that may be present in enterprise environments without proper security controls.