Overview

A vulnerability in the TOTOLINK X5000R V9.1.0cu.2415 web management interface allows an unauthenticated remote attacker on the LAN to crash the web service via a segmentation fault. By sending an oversized HTTP POST request to the CGI endpoint, an attacker can trigger memory exhaustion, leading to a Denial of Service (DoS).

Vulnerability Details

The vulnerability stems from the lack of request size enforcement in the firmware's Lighttpd configuration. Specifically, the following limit is commented out:

#server.max-request-size = 16384

Because this limit is not enforced, the CGI endpoint /cgi-bin/cstecgi.cgi can receive extremely large request bodies. Based on decompilation of the firmware, the CGI handler reads and trusts the CONTENT_LENGTH header provided by the user, attempting to allocate memory directly based on this controlled size.

On the physical device (which has 256MB RAM), this allocation can exceed available resources, leading to a Segmentation fault (core dumped) and a crash of the management functionality.

Reproduction

1. Send a POST request with a very large JSON body to /cgi-bin/cstecgi.cgi.
2. Inflate a field (such as token) to grow the request size well beyond safe limits.
3. The device crashes due to memory exhaustion.