CVE-2024-0573 is a high severity stack buffer overflow flaw in Totolink LR1200GB, scored CVSS 8.8. The record lists firmware 9.1.0u.6619_B20230130. The vendor did not respond to early contact, so no fix is known from the record. Read the checks below to find out whether you run an affected build.
What's affected
The record lists firmware 9.1.0u.6619_B20230130. The setDiagnosisCfg function mishandles the ip argument.
The record places the flaw in the setDiagnosisCfg function of /cgi-bin/cstecgi.cgi or the named handler, reachable remotely, with a public disclosure noted. The CVSS vector in the record is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Fixed version: The vendor did not respond to early contact, so no fix is known from the record.
How to check if you're exposed
Log in to the router admin page and read the firmware version on the status or system page, then compare it with the version named in the record. Also check whether the admin page is reachable from the WAN side.
The request path /cgi-bin/cstecgi.cgi is the common web handler on these devices, so any exposure of the admin interface to the internet is worth closing regardless of the firmware version.
What to do now
- Turn off remote administration from the WAN side and limit the admin page to a trusted management network.
- Check the vendor site for the firmware version named in the advisory and install it where one exists.
- If the vendor offers no fix, plan to replace the device or place it behind a firewall that blocks access to its web interface.
- Change administrator credentials and wireless keys if the device was ever exposed.
Why it matters
CWE-121 describes this class. A stack based buffer overflow occurs when a program copies input into a fixed size buffer on the call stack without checking the length. The excess data overwrites neighbouring memory, which can crash the program or change its behaviour. On embedded devices the web service often runs with high privileges, which raises the stakes of any memory safety bug in it.
The record notes that an exploit has been disclosed publicly, which shortens the time between disclosure and scanning by others. The record does not say the flaw is exploited in the wild, and it is not in the CISA KEV catalog.
Safeguard Gold keeps a page for this CVE at gold.safeguard.sh, and the free in-browser dependency scan can show whether software you build bundles related components.
Quick check
Is CVE-2024-0573 exploited in the wild?
The record's KEV flag is false, and none of the pages I fetched said otherwise. That is not proof of safety, so still patch or restrict access.
What if the vendor never ships a fix?
Limit the admin interface to a trusted network, disable remote management, and plan to replace the device.
Sources
- Safeguard Gold entry for CVE-2024-0573
- NVD record data for CVE-2024-0573, including the references listed there (the other reference pages were not fetched for this post).
Last reviewed: 19 October 2026.
