External risk intelligence

TOTOLINK CP900L Stack Overflow via desc Parameter in setMacFilterRules

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2024-35398

This device is a networking product (TOTOLINK CP900L). Such devices are commonly deployed at the edge of networks, and administrative management interfaces are frequently exposed to or accessible from network-connected environments, making them a common target for internet-reachable interaction.

Buffer Overflow

Totolink Cp900l Firmware

4.1.5cu.798_b20221228

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability found in TOTOLINK networking devices. The issue, a stack overflow, could allow unauthorized access and control over the affected devices. The primary concern is to confirm if these devices are in use within our environment and assess any potential exposure.

Flaw allows unauthorized device control.
Critical vulnerability in networking devices.
Confirm device relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could target the administrative interface of a TOTOLINK CP900L router exposed to the network. By sending a specially crafted request containing a large 'desc' parameter to the `setMacFilterRules` function, they could trigger a stack overflow vulnerability. This could allow the attacker to crash the device, potentially leading to denial of service or enabling further system compromise.

No authentication or network access required.
Triggered via the `setMacFilterRules` function.
Leads to denial of service or system compromise.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, a stack overflow in the `setMacFilterRules` function could allow an unauthenticated attacker to cause a denial of service or potentially execute arbitrary code. This could affect the device's availability and integrity by disrupting its normal operation.

Device availability and integrity.
Network access with crafted requests.
Denial of service or code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

The TOTOLINK CP900L firmware is likely managed by the network infrastructure or IT operations teams responsible for managing edge devices. The first practical step is to identify all deployed CP900L devices, determine their network exposure, and confirm business criticality to prioritize remediation efforts.

Network or infrastructure teams own this.
Verify device network exposure and criticality.
Plan remediation within maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the TOTOLINK CP900L?

The TOTOLINK CP900L is a networking device, specifically a router, designed to manage internet connectivity and data traffic. It functions as a gateway for home or small office environments, routing traffic between connected local devices and the broader internet. Because it handles network traffic and typically features an administrative management interface for configuration, it acts as a critical point of control for the network segments it serves.

What does this stack overflow vulnerability mean?

This vulnerability is classified as CWE-120, which is a buffer copy without checking size. In simple terms, the device's software fails to verify the length of data provided in the 'desc' parameter before processing it. By sending an unexpectedly large amount of data to the setMacFilterRules function, an attacker can overwhelm the memory allocated for that task. This can corrupt the device's normal operation, leading to a crash or, more severely, the ability to run unauthorized code.

How is the CVE-2024-35398 vulnerability triggered?

The flaw is triggered by sending a specially crafted network request to the device's administrative interface targeting the setMacFilterRules function. Importantly, the vulnerability does not require the attacker to have valid login credentials or prior access to the system. Simply reaching the device over the network with the malicious 'desc' parameter is sufficient; regular, correctly formatted management traffic will not trigger this issue.

Is my network at risk from this TOTOLINK issue?

Halo Surface Signal indicates that the TOTOLINK CP900L is a networking product often deployed at the edge of a network, meaning it is frequently placed where its administrative interfaces are reachable from network-connected environments. If your device is configured to be accessible from the internet or exposed to untrusted network segments, it is at higher risk. Devices kept strictly on isolated internal segments are generally less reachable but still require attention.

Do I need to take action if I use this device?

Yes. Your first priority is to create an inventory of all TOTOLINK CP900L units in your environment. Once identified, evaluate whether these devices are exposed to your local or external network. Determine how critical the device is to your daily operations so you can schedule maintenance to apply available updates or implement network-level controls to restrict access to the administrative interface until you can update the firmware.

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.