CVE-2024-31806 in EX200
Summary
by MITRE • 04/08/2024
TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a Denial-of-Service (DoS) vulnerability in the RebootSystem function which can reboot the system without authorization.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 06/14/2025
The vulnerability identified as CVE-2024-31806 affects the TOTOLINK EX200 router model running firmware version V4.0.3c.7646_B20201211 and represents a critical denial-of-service weakness in the system's reboot functionality. This issue stems from inadequate authentication mechanisms within the RebootSystem function, which allows unauthorized users to trigger system restarts remotely without proper authorization. The vulnerability specifically targets the device's administrative interface where the reboot command is processed, making it particularly concerning for network infrastructure devices that require reliable uptime and continuous operation.
The technical flaw manifests through a lack of proper access control validation within the firmware's reboot implementation. When a remote attacker sends a specially crafted request to the device's management interface, the system executes the reboot command without verifying the sender's credentials or administrative privileges. This weakness falls under CWE-284 which addresses improper access control, specifically the lack of authentication checks for critical system functions. The vulnerability can be exploited through various network protocols including http or https depending on the device's configuration, making it accessible to attackers who can reach the device's management interface from external networks.
The operational impact of this vulnerability extends beyond simple service disruption as unauthorized system reboots can cause significant network instability and potential data loss. Network administrators may experience unexpected downtime when the device reboots automatically, potentially affecting connected devices and services that depend on continuous network connectivity. The vulnerability particularly affects enterprise and home network environments where routers serve as critical infrastructure components, and unexpected reboots could lead to cascading failures in network services. Additionally, repeated exploitation could cause hardware degradation through frequent power cycling events, potentially shortening device lifespan.
Mitigation strategies for this vulnerability should focus on implementing immediate network-level protections while awaiting official firmware updates from TOTOLINK. Network administrators should restrict access to the device's management interface through firewall rules, limiting access to trusted IP addresses only and disabling remote management where possible. The recommended approach includes configuring access control lists to prevent unauthorized network access to the device's web interface and management ports. Security professionals should also consider implementing network monitoring solutions to detect unusual reboot patterns that could indicate exploitation attempts. Organizations should prioritize updating to the latest firmware version once available, as this will address the underlying authentication flaw and prevent unauthorized system restarts. The vulnerability also highlights the importance of regular firmware updates and proper network segmentation to limit the attack surface of network infrastructure devices. This issue aligns with ATT&CK technique T1499 which covers network disruption and service denial, emphasizing the need for robust access controls in network device management interfaces.