PT-2017-7785 · NetGear · Netgear Wnr2000V5

Pedro Ribeiro · Published 2017-01-30 · Updated 2017-09-03 · CVE-2016-10176

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NETGEAR WNR2000v5 router

Description The issue allows an unauthenticated user to perform sensitive actions on the device by invoking a specific URL on the web server. This can be exploited to change router settings, such as password-recovery questions, and achieve remote code execution. The embedded web server (uhttpd) handles the apply.cgi and apply noauth.cgi URLs, with the latter allowing unauthorized access to perform these actions.

Recommendations For the NETGEAR WNR2000v5 router, consider restricting access to the apply noauth.cgi URL as a temporary workaround until a patch is available. Avoid using the apply noauth.cgi URL in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2016-10176

Affected Products

Netgear Wnr2000V5

References · 8

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/netgear_wnr2000_pass_recovery.rb · Exploit
• 🔥 https://exploit-db.com/exploits/40949 · Exploit
• 🔥 https://raw.githubusercontent.com/pedrib/PoC/master/advisories/netgear-wnr2000.txt · Exploit
• 🔥 http://seclists.org/fulldisclosure/2016/Dec/72 · Exploit
• https://osv.dev/vulnerability/CVE-2016-10176 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-10176 · Security Note
• http://kb.netgear.com/000036549/Insecure-Remote-Access-and-Command-Execution-Security-Vulnerability · Vendor Advisory
• http://securityfocus.com/bid/95867 · Note