CVE-2024-8573: A vulnerability, which was classified as critical, was found in TOTOLINK AC1200 T8 and AC1200 T10 4.1.5cu.861_B20230220/4.1.8cu.5207. This affects the function…

PriorityP265high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

EPSS

1.42%

70.0th percentile

A vulnerability, which was classified as critical, was found in TOTOLINK AC1200 T8 and AC1200 T10 4.1.5cu.861_B20230220/4.1.8cu.5207. This affects the function setParentalRules of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument desc/week/sTime/eTime leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
totolink	ac1200_t10	—	—
totolink	ac1200_t10	—	—
totolink	ac1200_t8	—	—
totolink	ac1200_t8	—	—
totolink	t10_firmware	—	—
totolink	t8_firmware	—	—

Detection & IOCsextracted from sources · hover to see the quote

path/cgi-bin/cstecgi.cgi↗

urlhttps://github.com/lin-3-start/lin-cve/blob/main/TOTOLINK%20A720R/TOTOLINK-A720R.md

snort

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Totolink setParentalRules Multiple Parameters Buffer Overflow Attempt (CVE-2024-8573)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:20; content:"/cgi-bin/cstecgi.cgi"; http.request_body; content:"|22|topicurl|22|"; content:"|22|setParentalRules|22|"; fast_pattern; within:23; pcre:"/\x22(?:desc|week|sTime|eTime)\x22(?:\x3a(?:\x20\x22|\x22))?[^\x2c\x7d$]{100,}(?:\x2c|\x7d|$)/"; reference:url,github.com/lin-3-start/lin-cve/blob/main/TOTOLINK%20A720R/TOTOLINK-A720R.md; reference:cve,2024-8573; classtype:web-application-attack; sid:2064066; rev:1; metadata:affected_product TOTOLINK, attack_target Networking_Equipment, tls_state plaintext, created_at 2025_08_20, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2025_08_20, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)

→Attack targets HTTP POST requests to /cgi-bin/cstecgi.cgi with a JSON body containing 'topicurl':'setParentalRules' and oversized (>=100 chars) values in the desc, week, sTime, or eTime parameters.
→The exploit is delivered in plaintext (no TLS), making it inspectable at the network perimeter or internally.
→MITRE mapping: TA0001 Initial Access / T1190 Exploit Public-Facing Application — prioritize perimeter and internal deployment of the Snort rule (SID 2064066).

·Affected firmware versions are TOTOLINK AC1200 T8 4.1.5cu.861_B20230220 and AC1200 T10 4.1.8cu.5207; ensure detection is scoped to traffic destined for these devices.
·The Snort PCRE triggers on parameter values ≥100 characters; tune the threshold if legitimate long values are expected in setParentalRules requests in your environment.

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.