PT-2020-7951 · NetGear · Netgear Prosafe Wc7600+2

Andrei Costin · Published 2020-03-23 · Updated 2020-03-25 · CVE-2016-11022

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: NETGEAR Prosafe WC9500 version 5.1.0.17 NETGEAR Prosafe WC7600 version 5.1.0.17 NETGEAR Prosafe WC7520 version 2.5.0.35

Description: The issue allows a remote attacker to execute code with root privileges via shell metacharacters in the reqMethod parameter to "login handler.php".

Recommendations: For NETGEAR Prosafe WC9500 version 5.1.0.17, consider disabling access to "login handler.php" until a patch is available. For NETGEAR Prosafe WC7600 version 5.1.0.17, restrict the use of the reqMethod parameter in "login handler.php" to minimize the risk of exploitation. For NETGEAR Prosafe WC7520 version 2.5.0.35, avoid using the reqMethod parameter in "login handler.php" until the issue is resolved.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2016-11022

Affected Products

Netgear Prosafe Wc7520

Netgear Prosafe Wc7600

Netgear Prosafe Wc9500

References · 6

• 🔥 https://github.com/threat9/routersploit/blob/master/routersploit/modules/exploits/routers/netgear/prosafe_rce.py · Exploit
• 🔥 http://firmware.re/vulns/acsa-2015-002.php · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2016-11022 · Security Note
• https://osv.dev/vulnerability/CVE-2016-11022 · Vendor Advisory
• https://t.me/cibsecurity/10679 · Telegram Post
• https://unit42.paloaltonetworks.com/new-mirai-variant-targets-enterprise-wireless-presentation-display-systems · Note