Totolink LR1200GB cstecgi.cgi setOpModeCfg stack-based overflow
CVE-2024-0572

9.8CRITICAL

Key Information:

Vendor: Totolink
Status: LR1200GB
Vendor: CVE Published:; 16 January 2024

Badges

👾 Exploit Exists🟡 Public PoC

Summary

A stack-based buffer overflow vulnerability exists in the Totolink LR1200GB router that affects the function setOpModeCfg within the CGI script /cgi-bin/cstecgi.cgi. By manipulating the argument pppoeUser, an attacker can exploit this vulnerability remotely, potentially leading to unauthorized access or system compromise. The vulnerability details have been publicly disclosed, and despite the vendor being alerted about the issue, there has been a lack of response from them.

Affected Version(s)

LR1200GB 9.1.0u.6619_B20230130

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-0572 - Proof of Concept