CVE-2024-32324 is a buffer overflow vulnerability classified under CWE-120, affecting Shenzhen Libituo Technology Co., Ltd's LBT-T300-T400 devices running firmware version 3.2. The vulnerability arises from improper bounds checking on the vpn_client_ip variable within the config_vpn_pptp function of the rc program, which manages VPN client configurations. A local attacker with low privileges can exploit this flaw by providing a specially crafted input to the vpn_client_ip variable, causing a buffer overflow that enables arbitrary code execution. This can lead to full compromise of the device, allowing the attacker to execute malicious code with the privileges of the rc program. The vulnerability does not require user interaction and has a low attack complexity, but it does require local access and low-level privileges, which limits remote exploitation. The CVSS v3.1 base score is 7.8, reflecting high impact on confidentiality, integrity, and availability. Currently, there are no known public exploits or patches, increasing the risk of targeted attacks if the vulnerability becomes widely known. The affected devices are typically used in VPN scenarios, making this vulnerability critical for organizations relying on these devices for secure remote access.

The exploitation of CVE-2024-32324 could lead to complete compromise of affected Shenzhen Libituo VPN devices, allowing attackers to execute arbitrary code locally. This can result in unauthorized access to sensitive network segments, interception or manipulation of VPN traffic, and disruption of VPN services. The confidentiality of data transmitted through the VPN could be severely impacted, as well as the integrity and availability of the VPN infrastructure. Organizations relying on these devices for secure remote access may face increased risk of lateral movement by attackers within their networks, data breaches, and potential service outages. The requirement for local access limits the scope but does not eliminate risk, especially in environments where physical or local network access is possible for attackers. The lack of available patches increases the window of exposure, necessitating immediate mitigation efforts to reduce risk.

Organizations should immediately restrict local access to Shenzhen Libituo LBT-T300-T400 devices, ensuring only trusted personnel have physical or network-level access. Implement strict network segmentation and access controls to limit exposure of these devices. Monitor device logs and network traffic for unusual activity indicative of exploitation attempts, such as unexpected process executions or configuration changes. Disable or restrict VPN client configuration interfaces if not required. Engage with Shenzhen Libituo Technology Co., Ltd to obtain information on forthcoming patches or firmware updates addressing this vulnerability. Prepare to apply patches promptly once available. Consider deploying host-based intrusion detection systems (HIDS) on management stations interacting with these devices to detect anomalous behavior. Conduct regular security audits and penetration tests focusing on local access vectors to identify and remediate potential exploitation paths. Maintain up-to-date backups of device configurations to enable rapid recovery in case of compromise.