PT-2014-4265 · Belkin · Belkin N750 Router

Marco Vaz · Published 2014-11-12 · Updated 2016-03-31 · CVE-2014-1635

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Belkin N750 Router with firmware before F9K1103 WW 1.10.17m

Description The issue is related to a buffer overflow in the login.cgi of MiniHttpd. This can be exploited by remote attackers to execute arbitrary code via a long string in the jump parameter.

Recommendations For Belkin N750 Router with firmware before F9K1103 WW 1.10.17m, update the firmware to version F9K1103 WW 1.10.17m or later to resolve the issue. As a temporary workaround, consider restricting access to the login.cgi page to minimize the risk of exploitation.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2014-1635

Affected Products

Belkin N750 Router

References · 10

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/belkin_login_bof.rb · Exploit
• 🔥 http://exploit-db.com/exploits/35184 · Exploit
• 🔥 https://labs.integrity.pt/articles/from-0-day-to-exploit-buffer-overflow-in-belkin-n750-cve-2014-1635 · Exploit
• 🔥 https://exploit-db.com/exploits/35184 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-1635 · Security Note
• http://belkin.com/us/support-article?articleNum=4831 · Vendor Advisory
• http://osvdb.org/show/osvdb/114345 · Note
• http://securitytracker.com/id/1031210 · Note
• http://securityfocus.com/bid/70977 · Note
• https://labs.integrity.pt/advisories/cve-2014-1635 · Note