CVE-2024-0570 is a high severity improper access control flaw in Totolink N350RT, scored CVSS 7.3. The record lists Totolink N350RT firmware 9.3.5u.6265. The record says to upgrade the affected component but names no version. Read the checks below to find out whether you run an affected build.
What's affected
The record lists Totolink N350RT firmware 9.3.5u.6265. The affected component is the Setting Handler in /cgi-bin/cstecgi.cgi.
The CVSS vector in the record is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, with a base score of 7.3 (High). KEV status: not listed in the record.
Fixed version: The record says to upgrade the affected component but names no version. Check the vendor download page and the CHT Security notice in the references.
Where sources differ: The VulDB description calls the issue critical, while the CVSS score in the record is 7.3, which is High.
How to check if you're exposed
Log in to the router admin page and read the firmware version on the status or system page, then compare it with the version named in the record. Also check whether the admin page is reachable from the WAN side.
The request path /cgi-bin/cstecgi.cgi is the common web handler on these devices, so any exposure of the admin interface to the internet is worth closing regardless of the firmware version.
What to do now
- Turn off remote administration from the WAN side and limit the admin page to a trusted management network.
- Check the vendor site for the firmware version named in the advisory and install it where one exists.
- If the vendor offers no fix, plan to replace the device or place it behind a firewall that blocks access to its web interface.
- Change administrator credentials and wireless keys if the device was ever exposed.
Why it matters
CWE-284 describes this class. Improper access control is a broad class. The system fails to restrict access to a resource or function to the parties who should have it. The record does not narrow the cause further, so the exact mechanism should be read from the vendor or coordinator advisory.
CWE-862 describes this class. Missing authorization means a function runs without checking whether the caller is allowed to use it. The request is accepted because nothing asks the question. Every handler on a device web interface needs its own authorization check, not just the login page.
The record notes that an exploit has been disclosed publicly, which shortens the time between disclosure and scanning by others. The record does not say the flaw is exploited in the wild, and it is not in the CISA KEV catalog.
Safeguard Gold keeps a page for this CVE at gold.safeguard.sh, and the free in-browser dependency scan can show whether software you build bundles related components.
Quick check
Is CVE-2024-0570 exploited in the wild?
The record's KEV flag is false, and none of the pages I fetched said otherwise. That is not proof of safety, so still patch or restrict access.
What if the vendor never ships a fix?
Limit the admin interface to a trusted network, disable remote management, and plan to replace the device.
Sources
- Safeguard Gold entry for CVE-2024-0570
- NVD record data for CVE-2024-0570, including the references listed there (the other reference pages were not fetched for this post).
Last reviewed: 19 October 2026.
