PT-2019-8313 · NetGear · Netgear Readynas Surveillance

Published 2019-06-11 · Updated 2019-10-09 · CVE-2017-18378

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NETGEAR ReadyNAS Surveillance versions prior to 1.4.3-17 x86 NETGEAR ReadyNAS Surveillance versions prior to 1.1.4-7 ARM

Description The issue arises from the fact that the uploaddir variable, obtained from $ GET['uploaddir'], is not properly escaped and is then passed to the system() function through $tmp upload dir. This leads to a remote command execution vulnerability, specifically through the "upgrade handle.php?cmd=writeuploaddir" endpoint.

Recommendations For versions prior to 1.4.3-17 x86, update to version 1.4.3-17 or later. For versions prior to 1.1.4-7 ARM, update to version 1.1.4-7 or later. As a temporary workaround, consider restricting access to the "upgrade handle.php" endpoint to minimize the risk of exploitation. Avoid using the uploaddir variable in the affected endpoint until the issue is resolved.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2017-18378

Affected Products

Netgear Readynas Surveillance

References · 5

• 🔥 https://exploit-db.com/exploits/42956 · Exploit
• https://kb.netgear.com/000049072/Security-Advisory-for-Command-Injection-in-ReadyNAS-Surveillance-Application-PSV-2017-2653 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-18378 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-18378 · Security Note
• https://t.me/cibsecurity/4847 · Telegram Post