CVE-2024-27571

Executive Summary

CVE-2024-27571 is a critical stack overflow vulnerability discovered in the LBT T300-T390 router firmware version v2.2.1.8. The flaw resides in the makeCurRemoteApList function, specifically within the handling of the ApCliSsid parameter. An unauthenticated attacker can trigger a Denial of Service (DoS) by sending a crafted POST request, causing the device to crash or become unresponsive. No public exploit code or patch is currently available, and the vendor has not released a fix. This vulnerability poses a significant risk to network availability for users of these devices.

Supply Chain & Package Security

This vulnerability is not related to any software package registry (NPM, PyPI, Go, Ruby). It is a firmware-level issue in embedded networking hardware from LBT.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, indicating insufficient data for a full vector calculation. However, based on the nature of the vulnerability (stack overflow via network request), a reasonable estimated vector would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)

Estimated CVSS v3.1 Score: 7.5 (High) – AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Threat Level: High. The vulnerability is remotely exploitable without authentication, leading to a complete denial of service.

Deep Dive & Mechanics

The vulnerability is a classic stack-based buffer overflow in the makeCurRemoteApList function. This function is likely responsible for parsing and processing the ApCliSsid parameter from an incoming POST request. The firmware does not properly validate the length of the input before copying it into a fixed-size stack buffer.

Mechanism:

1. An attacker sends an HTTP POST request to the vulnerable endpoint (likely the router's web management interface).
2. The request contains an ApCliSsid parameter with a value exceeding the expected buffer size.
3. The makeCurRemoteApList function copies this oversized input into a stack buffer without bounds checking.
4. The overflow corrupts adjacent stack memory, including the return address and other critical data.
5. This corruption causes the device to crash (DoS) or potentially allows arbitrary code execution if the attacker carefully crafts the payload.

Root Cause: Lack of input validation and unsafe memory copy operations (e.g., strcpy, sprintf, or memcpy without length checks) in the firmware's HTTP request handler.

Vulnerable vs. Patched Code

Since no patch is available, a comparison cannot be made. However, a secure implementation would include:

Vulnerable Code (Conceptual):

void makeCurRemoteApList(char *ApCliSsid) {
    char buffer[64];
    strcpy(buffer, ApCliSsid); // Unsafe: no bounds check
    // ... process buffer
}

Patched Code (Conceptual):

void makeCurRemoteApList(char *ApCliSsid) {
    char buffer[64];
    strncpy(buffer, ApCliSsid, sizeof(buffer) - 1); // Safe: limits copy size
    buffer[sizeof(buffer) - 1] = '\0'; // Ensure null termination
    // ... process buffer
}

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• LBT T300 or T390 router with firmware v2.2.1.8
• Network access to the router's web interface (typically on port 80 or 443)
• A tool like curl, Burp Suite, or a custom Python script

Exploitation Steps:

1. Identify the vulnerable endpoint. Based on the description, it is likely /goform/setApCliSsid or similar.
2. Craft a POST request with an overly long ApCliSsid parameter.
3. Send the request to the router.

Example using curl:

curl -X POST http://192.168.1.1/goform/setApCliSsid \
  -d "ApCliSsid=$(python3 -c 'print("A"*1000)')"

Expected Outcome: The router becomes unresponsive or reboots, causing a denial of service.

Blue Team (Defensive)

Detection & Prevention:

• Network Monitoring: Monitor for HTTP POST requests to /goform/setApCliSsid with abnormally long parameter values.
• Input Validation: Implement strict input length limits on all web form parameters.
• Firmware Hardening: Apply stack canaries and ASLR if the firmware supports it.
• Segmentation: Isolate IoT devices like routers on a separate VLAN to limit blast radius.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /goform/setApCliSsid with ApCliSsid parameter exceeding 64 characters.
  • Repeated connection timeouts or RST packets from the router IP.
• System IOCs:
  • Router logs showing unexpected crashes or reboots.
  • Unresponsive web interface after a POST request.
• File IOCs:
  • Firmware binary with unsafe strcpy or sprintf calls in the HTTP handler.

Detection Engineering

YARA Rule

rule CVE_2024_27571_LBT_StackOverflow {
    meta:
        description = "Detects LBT T300-T390 firmware with stack overflow vulnerability in makeCurRemoteApList"
        author = "Valters IT"
        date = "2024-03-01"
        reference = "CVE-2024-27571"
    strings:
        $s1 = "makeCurRemoteApList" ascii wide nocase
        $s2 = "ApCliSsid" ascii wide nocase
        $s3 = "strcpy" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-27571 LBT Router Stack Overflow Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP POST requests targeting LBT routers with oversized ApCliSsid parameter
author: Valters IT
date: 2024/03/01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/goform/setApCliSsid'
        cs-uri-query|length: > 200
    condition: selection
falsepositives:
    - Legitimate long SSID names (unlikely)
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2024-27571 LBT Router Stack Overflow Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/goform/setApCliSsid"; http_uri;
    pcre:"/ApCliSsid=[^&]{200,}/";
    sid:1000001;
    rev:1;
    reference:cve,2024-27571;
    classtype:attempted-dos;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable Remote Management: If not required, disable the web interface from the WAN side.
2. Network Segmentation: Place the router on a separate VLAN with strict firewall rules.
3. Monitor Logs: Enable logging and monitor for unusual POST requests or crashes.

Long-Term Fix:

• Vendor Patch: Await an official firmware update from LBT. Contact the vendor for an ETA.
• Firmware Replacement: If available, consider flashing an alternative open-source firmware (e.g., OpenWrt) that is actively maintained.
• Device Replacement: If no patch is forthcoming, replace the device with a more secure alternative.

Workaround:

• Implement a reverse proxy or WAF (Web Application Firewall) in front of the router to filter oversized parameters.

Valters IT
Securing Digital Frontiers