CVE-2024-0578

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability classified as critical has been found in Totolink LR1200GB 9.1.0u.6619_B20230130. Affected is the function UploadCustomModule of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument File leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-250794 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121

Affected software

Vendor	Product	Versions
Totolink	LR1200GB	9.1.0u.6619_B20230130
totolink	lr1200gb_firmware	9.1.0u.6619_b20230130

References

https://github.com/jylsec/vuldb/blob/main/TOTOLINK/LR1200GB/8/README.mdBroken Link
https://vuldb.com/?ctiid.250794Permissions Required, Third Party Advisory
https://vuldb.com/?id.250794Third Party Advisory
https://github.com/jylsec/vuldb/blob/main/TOTOLINK/LR1200GB/8/README.mdBroken Link
https://vuldb.com/?ctiid.250794Permissions Required, Third Party Advisory
https://vuldb.com/?id.250794Third Party Advisory

Timeline

Published: Jan 16, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-05799.8A vulnerability classified as critical was found in Totolink X2000R 1.0.0-B20221212.1452. Affected by this vulnerability is the function for CVE-2024-05807.5Omission of user-controlled key authorization in the IDMSistemas platform, affecting the QSige product. This vulnerability allows an attacke CVE-2024-05815.5An Uncontrolled Resource Consumption vulnerability has been found on Sandsprite Scdbg.exe, affecting version 1.0. This vulnerability allows CVE-2024-05827.8A memory leak flaw was found in the Linux kernel’s io_uring functionality in how a user registers a buffer ring with IORING_REGISTER_PBUF_RI CVE-2024-05855.4The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to St CVE-2024-05866.4The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to St CVE-2024-05876.1The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'disqus_name' paramet CVE-2024-05884.3The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Cross-Site Req CVE-2024-05895.4Cross-site scripting (XSS) vulnerability in the entry overview tab in Devolutions Remote Desktop Manager 2023.3.36 and earlier on Windows al CVE-2024-05906.1The Microsoft Clarity plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9.3. This is CVE-2024-05916.1The wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scr CVE-2024-05925.4The Related Posts for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.1