TOTOLINK N600R cstecgi.cgi Stack Overflow RCE Analysis CVE-121

Vulnerability Overview Vulnerability Name: TOTOLINK N600R cstecgi.cgi strcpy/sprintf Multi-Function Stack Overflow Vulnerability Type: Stack Overflow / Remote Code Execution (RCE) CVE ID: CVE-121 CVSS v3.1 Score: 9.8 Critical Vulnerability Description: The binary in the firmware V4.3.0cu_7647_B20210106 of the TOTOLINK N600R Wireless N Router contains a widespread stack overflow vulnerability. A total of 24 functions use and/or to copy user-supplied HTTP parameters into fixed-size stack buffers without performing boundary checks. The affected functions range from large handlers (up to 5520 bytes) to extremely small utility functions ( and ) with only 100 bytes, representing an almost minimal attack surface. All calls indirectly invoke via the MIPS GOT. In the MIPS32 Big Endian architecture, the return address ( ) is located at the top of the stack frame, meaning that a stack buffer overflow immediately overwrites the return address, allowing direct control of the program counter without requiring additional exploitation primitives. The firmware was compiled without stack protection or other mitigations. Scope of Impact Affected Products: Vendor: TOTOLINK Product: N600R Wireless N Router Firmware Version: V4.3.0cu_7647_B20210106 Affected Binary: (192KB MIPS32 BE) Hardware Platform: MIPS32 Big Endian, GP=0x447CF0, GOT base=0x43fd00 Authentication Required: None (LAN/WAN) Vulnerability Classification: Vulnerability Type: Stack Overflow / Remote Code Execution (RCE) CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Attack Vector: Network Attack Complexity: Low Required Privileges: None User Interaction: None Scope: Unchanged Confidentiality Impact: High Integrity Impact: High Availability Impact: High Remediation Vendor Recommendations: 1. Replace all calls with or and enforce strict target buffer size limits. 2. Replace with to prevent buffer overflows caused by format strings. 3. Enable stack protection: Compile with . 4. Enable to check buffer lengths known at compile time. 5. Validate the size of all inputs before copying them to the target buffer. 6. Conduct a comprehensive audit of the identified 24 / calls. User Mitigations (Until Patch is Available): Restrict access to the web management interface via firewall rules. Disable WAN-side management. Deploy network-level WAF rules to block oversized HTTP POST parameter values sent to . Proof of Concept (POC) Code Other Overflow Targets Impact Successful exploitation allows an unauthenticated remote attacker to: Overflow stack buffers in 24 different functions via standard HTTP POST requests. Overwrite the return address ( ) and hijack the execution flow. Execute arbitrary code with root privileges via ROP chains or shellcode. Gain full control of the router—reading, modifying, or extracting all configuration data. Install a persistent backdoor in flash memory. Utilize the compromised router for lateral movement within the internal network. Cause Denial of Service (device crash/restart). The combination of 24 overflow vectors, lack of stack protection, predictable layout on MIPS32 BE, and absence of ASLR on embedded platforms makes this an extremely reliable exploitation target. Discovery Methodology Tools: angr 9.2.221 CFGFast + Custom MIPS GOT indirect call resolver Method: ELF PHDR scanning -> GP register extraction (0x447CF0) -> GOT entry parsing (base 0x43fd00) -> Identification of / call sites (GOT ) Input Source Tracking: @ 0x4296E0, Main Dispatcher @ 0x422870 Evidence: 24 confirmed functions using / , 12 pure overflows + 12 dual-risk ( + overflow)

Goal Reached Thanks to every supporter — we hit 100%!

TOTOLINK N600R cstecgi.cgi Stack Overflow RCE Analysis CVE-121

More from this source