Executive brief
A security vulnerability has been identified in ToToLink LR1200GB and NR1800X routers, which are used to provide wireless internet connectivity. An attacker can send a specially crafted web request to the device to cause a system crash or potentially take control of the router. This attack can be performed remotely over the network without requiring any login credentials or user interaction.
Technical details
A stack-based buffer overflow (CWE-121) exists in the 'setDefResponse' function within the 'cstecgi.cgi' binary of affected ToToLink router firmware. The vulnerability is caused by the use of the 'strcpy()' function to copy the 'IpAddress' parameter from a JSON web request into a fixed-size stack buffer without performing length validation. An unauthenticated remote attacker can exploit this by sending a POST request with an oversized 'IpAddress' string, leading to memory corruption or potential arbitrary code execution. A public Proof of Concept (PoC) demonstrating the overflow has been disclosed.
Affected products
- ToToLink LR1200GB firmware V9.1.0u.6619_B20230130
- ToToLink NR1800X firmware V9.1.0u.6681_B20230703
Timeline
- 2025-11-13: advisory: NVD published the CVE record