PT-2017-7785 · NetGear · Netgear Wnr2000V5

Pedro Ribeiro · Publicado 2017-01-30 · Atualizado 2017-09-03 · CVE-2016-10176

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NETGEAR WNR2000v5 router

Description The issue allows an unauthenticated user to perform sensitive actions on the device by invoking a specific URL on the web server. This can be exploited to change router settings, such as password-recovery questions, and achieve remote code execution. The embedded web server (uhttpd) handles the apply.cgi and apply noauth.cgi URLs, with the latter allowing unauthorized access to perform these actions.

Recommendations For the NETGEAR WNR2000v5 router, consider restricting access to the apply noauth.cgi URL as a temporary workaround until a patch is available. Avoid using the apply noauth.cgi URL in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2016-10176

Produtos afetados

Netgear Wnr2000V5

Referências · 8

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/netgear_wnr2000_pass_recovery.rb · Exploit
• 🔥 https://exploit-db.com/exploits/40949 · Exploit
• 🔥 https://raw.githubusercontent.com/pedrib/PoC/master/advisories/netgear-wnr2000.txt · Exploit
• 🔥 http://seclists.org/fulldisclosure/2016/Dec/72 · Exploit
• https://osv.dev/vulnerability/CVE-2016-10176 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-10176 · Nota de Segurança
• http://kb.netgear.com/000036549/Insecure-Remote-Access-and-Command-Execution-Security-Vulnerability · Aviso do Fabricante
• http://securityfocus.com/bid/95867 · Nota