CVE-2024-1783 is a critical (CVSS 9.8) stack based buffer overflow in the web interface of the Totolink LR1200GB router, on firmware 9.1.0u.6619_B20230130 and 9.3.5u.6698_B20230810. It can be attacked remotely. The record names no fix and says the vendor never replied, so lock down the admin interface.
What's affected
Totolink LR1200GB, firmware 9.1.0u.6619_B20230130 and 9.3.5u.6698_B20230810.
The affected function is loginAuth in /cgi-bin/cstecgi.cgi, part of the web interface. According to the description, the http_host argument leads to a stack based buffer overflow, and the attack can be launched remotely. The weakness is CWE-121, stack based buffer overflow.
The description says the exploit has been disclosed publicly and may be used, and that the vendor was contacted early but did not respond in any way. The NVD score of 9.8 and the description agree on severity here, so there is no rating conflict to resolve.
No fixed firmware version is named in the record. A write-up linked from the record is hosted as a public gist, which I could not verify.
How to check if you're exposed
Log in to the router's admin page and read the model and firmware version, usually under System, Status or About. Compare it with the version named above.
You can also check from your own network without logging in, by looking at the device label for the model and revision, then matching it to the list above. Revision matters, because vendors often ship several hardware revisions under one model name.
Two more checks are worth doing on any consumer or small office router:
nmap -p 23,80,443,8080 192.168.0.1
Replace the address with your router's. If the management interface answers on a port you did not expect, or on the WAN side, that is a finding in its own right. Only scan devices you own or administer.
What to do now
- Identify every affected model on your network, including routers at remote offices and at employees' homes if you manage them.
- Check the vendor support page for a firmware release that names this CVE. The record says the vendor did not respond to the disclosure, so a fix may not exist.
- Turn off remote management on the WAN side and limit the admin interface to a trusted LAN segment or VLAN.
- Change the default admin password and make sure it is unique to the device.
- If no fix is available and the device is exposed, plan to replace it with supported hardware.
Why it matters
A stack buffer overflow happens when code copies input into a fixed size buffer on the stack without checking its length. A crafted value can overwrite nearby memory, and in the worst case it lets an attacker run code of their choosing. The component here handles login, so it processes data before any authentication succeeds, which is why the score is at the top of the scale.
The CVSS vector in the record gives a network attack path with no privileges and no user interaction. For an embedded device that often sits at the edge of a network, that is the combination defenders worry about most.
Nothing retrieved says it is exploited in the wild, and the record's Known Exploited Vulnerabilities flag is false. Public disclosure still means attackers can test it against any exposed device.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does the attacker need a password?
The affected function handles login, and the vector lists no privilege requirement. Assume an unauthenticated attacker with network access can try it.
Which firmware builds are listed?
9.1.0u.6619_B20230130 and 9.3.5u.6698_B20230810. Other builds are not listed in the record, which does not mean they are safe.
Sources
- NVD record for CVE-2024-1783
- VulDB entry 254574 (listed in the record, not retrievable when reviewed)
- Public write-up gist (listed in the record, not retrievable when reviewed)
Last reviewed: 19 October 2026.
