TOTOLINK setParentalRules Multiple Parameters Buffer Overflow Attempt (CVE-2024-8573)

Tim Peck@timpeck

•updated Nov 10, 2025•0•18

This rule detects an attempt to exploit a buffer overflow vulnerability (CVE-2024-8573) in TOTOLINK devices. The exploit targets the `setParentalRules` function within the `/cgi-bin/cstecgi.cgi` endpoint, specifically looking for HTTP POST requests with multiple parameters (desc, week, sTime, eTime) containing excessively long values (100 or more characters), indicative of a buffer overflow attempt.