LBT-T300-HW1 (<= 1.2.8) — CraftedSignal Threat Feed

Shenzhen Libituo Technology LBT-T300-HW1 Buffer Overflow Vulnerability

hello@craftedsignal.io — Sun, 03 May 2026 03:16:15 +0000

A buffer overflow vulnerability, identified as CVE-2026-7675, affects Shenzhen Libituo Technology LBT-T300-HW1 devices with firmware versions up to 1.2.8. The vulnerability resides in the start_lan function within the /apply.cgi file. By manipulating the Channel/ApCliSsid argument, a remote attacker can trigger a buffer overflow, potentially leading to arbitrary code execution. Publicly available exploit code exists for this vulnerability. The vendor was notified about the vulnerability, but there has been no response. This vulnerability is considered critical due to the potential for remote exploitation and the availability of exploit code.

Attack Chain

The attacker identifies a vulnerable Shenzhen Libituo Technology LBT-T300-HW1 device running firmware version 1.2.8 or earlier.
The attacker crafts a malicious HTTP request targeting the /apply.cgi endpoint.
The HTTP request includes a specially crafted Channel/ApCliSsid argument designed to overflow the buffer in the start_lan function.
The vulnerable start_lan function receives the malicious input and attempts to process it without proper bounds checking.
The buffer overflow occurs, overwriting adjacent memory regions, including potentially the return address on the stack.
The attacker gains control of the program execution flow by overwriting the return address with the address of malicious code.
The injected code executes with the privileges of the web server process.
The attacker achieves arbitrary code execution, potentially gaining full control of the device.

Impact

Successful exploitation of this vulnerability allows a remote attacker to execute arbitrary code on the affected device. Given that this is a router, this could lead to complete compromise of the device, including the ability to intercept and manipulate network traffic, install malware, or use the device as part of a botnet. Due to the public availability of the exploit, widespread exploitation is possible.

Recommendation

Apply network intrusion detection system (NIDS) rules to detect and block malicious HTTP requests targeting /apply.cgi with excessively long Channel/ApCliSsid values.
Deploy the Sigma rule Detect-LBT-T300-HW1-applycgi-buffer-overflow to your SIEM and tune for your environment to identify exploitation attempts.
Monitor web server logs for suspicious POST requests to /apply.cgi and analyze the length of the Channel/ApCliSsid parameter.

Shenzhen Libituo Technology LBT-T300-HW1 Buffer Overflow Vulnerability

hello@craftedsignal.io — Sun, 03 May 2026 02:17:12 +0000

A buffer overflow vulnerability, identified as CVE-2026-7674, affects Shenzhen Libituo Technology LBT-T300-HW1 devices up to version 1.2.8. The vulnerability resides within the Web Management Interface, specifically in the start_single_service function. By sending a crafted request to the device and manipulating the vpn_pptp_server or vpn_l2tp_server arguments, an attacker can trigger a buffer overflow, potentially leading to arbitrary code execution. This vulnerability can be exploited remotely, making it a significant threat to affected devices. The vendor was notified but did not respond, increasing the risk of exploitation.

Attack Chain

The attacker identifies a vulnerable LBT-T300-HW1 device with version 1.2.8 or earlier.
The attacker crafts a malicious HTTP request targeting the Web Management Interface.
The malicious request includes a payload designed to overflow the buffer when processing the vpn_pptp_server or vpn_l2tp_server arguments.
The crafted request is sent to the start_single_service function.
The start_single_service function attempts to process the overly long input without proper bounds checking.
The buffer overflow overwrites adjacent memory regions, including potentially executable code or critical data structures.
The attacker gains control of the device by redirecting execution flow to attacker-controlled code injected into the buffer.
The attacker executes arbitrary code on the device, potentially gaining persistent access or causing denial of service.

Impact

Successful exploitation of this vulnerability allows a remote attacker to execute arbitrary code on the affected LBT-T300-HW1 device. This could lead to complete system compromise, including data theft, modification of device settings, or use of the device as a bot in a larger attack. Given the lack of vendor response, many devices could be vulnerable if exposed to the internet.

Recommendation

Deploy the Sigma rule Detect Suspicious VPN Server Configuration via Web Interface to detect potential exploitation attempts targeting the vulnerable start_single_service function in web server logs.
Monitor network traffic for unusually long strings passed as values for vpn_pptp_server and vpn_l2tp_server parameters in HTTP requests to the device’s web interface.
Apply any available patches or firmware updates released by Shenzhen Libituo Technology to address CVE-2026-7674.