TOTOLINK LR1200GB

Totolink LR1200GB Web Interface cstecgi.cgi loginAuth stack-based overflow

TOTOLINK LR1200GB V9.1.0u.6619_B20230130 was discovered to contain a stack overflow via the password parameter in the function loginAuth.

Totolink LR1200GB cstecgi.cgi setOpModeCfg os command injection

Totolink LR1200GB cstecgi.cgi setUploadSetting os command injection

Totolink LR1200GB cstecgi.cgi setUssd os command injection

Totolink LR1200GB cstecgi.cgi setWanCfg os command injection

Totolink LR1200GB cstecgi.cgi setSmsCfg stack-based overflow

Totolink LR1200GB cstecgi.cgi setOpModeCfg stack-based overflow

Totolink LR1200GB cstecgi.cgi setParentalRules stack-based overflow

Totolink LR1200GB cstecgi.cgi setTracerouteCfg stack-based overflow

Totolink LR1200GB cstecgi.cgi setDiagnosisCfg stack-based overflow

Totolink LR1200GB cstecgi.cgi UploadCustomModule stack-based overflow

Totolink LR1200GB cstecgi.cgi setIpPortFilterRules stack-based overflow

Totolink LR1200GB cstecgi.cgi setLanguageCfg stack-based overflow

Totolink LR1200GB cstecgi.cgi UploadFirmwareFile command injection

An unauthenticated command injection vulnerability exists in the ToToLink LR1200GB Router firmware V9.1.0u.6619_B20230130 within the cstecgi.cgi binary (sub_41EC68 function). The binary reads the "imei" parameter from a web request and verifies only that it is 15 characters long. The parameter is then directly inserted into a system command using sprintf() and executed with system(). Maliciously crafted IMEI input can execute arbitrary commands on the router without authentication.

A stack buffer overflow vulnerability exists in the ToToLink LR1200GB (V9.1.0u.6619_B20230130) and NR1800X (V9.1.0u.6681_B20230703) Router firmware within the cstecgi.cgi binary (sub_42F32C function). The web interface reads the "lang" parameter and constructs Help URL strings using sprintf() into fixed-size stack buffers without proper length validation. Maliciously crafted input can overflow these buffers, potentially leading to arbitrary code execution or memory corruption, without requiring authentication.

A stack buffer overflow vulnerability exists in the ToToLink LR1200GB (V9.1.0u.6619_B20230130) and NR1800X (V9.1.0u.6681_B20230703) Router firmware within the cstecgi.cgi binary (setDefResponse function). The binary reads the "IpAddress" parameter from a web request and copies it into a fixed-size stack buffer using strcpy() without any length validation. Maliciously crafted input can overflow the buffer, leading to potential arbitrary code execution or memory corruption, without requiring authentication.

A local stack-based buffer overflow vulnerability exists in the infostat.cgi and cstecgi.cgi binaries of ToToLink routers (A720R V4.1.5cu.614_B20230630, LR1200GB V9.1.0u.6619_B20230130, and NR1800X V9.1.0u.6681_B20230703). Both programs parse the contents of /proc/net/arp using sscanf() with "%s" format specifiers into fixed-size stack buffers without length validation. Specifically, one function writes user-controlled data into a single-byte buffer, and the other into adjacent small arrays without bounds checking. An attacker who controls the contents of /proc/net/arp can trigger memory corruption, leading to denial of service or potential arbitrary code execution.