PT-2019-8313 · NetGear · Netgear Readynas Surveillance

Publicado 2019-06-11 · Atualizado 2019-10-09 · CVE-2017-18378

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NETGEAR ReadyNAS Surveillance versions prior to 1.4.3-17 x86 NETGEAR ReadyNAS Surveillance versions prior to 1.1.4-7 ARM

Description The issue arises from the fact that the uploaddir variable, obtained from $ GET['uploaddir'], is not properly escaped and is then passed to the system() function through $tmp upload dir. This leads to a remote command execution vulnerability, specifically through the "upgrade handle.php?cmd=writeuploaddir" endpoint.

Recommendations For versions prior to 1.4.3-17 x86, update to version 1.4.3-17 or later. For versions prior to 1.1.4-7 ARM, update to version 1.1.4-7 or later. As a temporary workaround, consider restricting access to the "upgrade handle.php" endpoint to minimize the risk of exploitation. Avoid using the uploaddir variable in the affected endpoint until the issue is resolved.

Exploit

Correção

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

CVE-2017-18378

Produtos afetados

Netgear Readynas Surveillance

Referências · 5

• 🔥 https://exploit-db.com/exploits/42956 · Exploit
• https://kb.netgear.com/000049072/Security-Advisory-for-Command-Injection-in-ReadyNAS-Surveillance-Application-PSV-2017-2653 · Aviso do Fabricante
• https://t.me/cibsecurity/4847 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2017-18378 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-18378 · Nota de Segurança