PT-2025-31695 · NetGear · Netgear Routers

Published 2012-10-15 · Updated 2025-09-23 · CVE-2013-10061

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Netgear routers versions 1.1.00.24 through 1.1.00.45

Description An authenticated OS command injection vulnerability exists due to improper input neutralization. This allows for command injection through crafted POST requests to the /setup.cgi API endpoint via the TimeToLive parameter. Successful exploitation enables remote attackers to deploy payloads or manipulate system state after authentication.

Recommendations For Netgear routers versions 1.1.00.24 through 1.1.00.45, restrict access to the setup.cgi endpoint or sanitize the TimeToLive parameter to prevent command injection.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2025-09548

CVE-2013-10061

Affected Products

Netgear Routers

References · 10

• 🔥 https://exploit-db.com/exploits/24464 · Exploit
• 🔥 https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/netgear_dgn1000b_setup_exec.rb · Exploit
• 🔥 https://exploit-db.com/exploits/24931 · Exploit
• 🔥 https://web.archive.org/web/20150218074318/http://s3cur1ty.de/m1adv2013-005 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-10061 · Security Note
• https://bdu.fstec.ru/vul/2025-09548 · Security Note
• https://vulncheck.com/advisories/netgear-legacy-routers-rce-2 · Note
• https://t.me/CVEtracker/28982 · Telegram Post
• https://t.me/cveNotify/136229 · Telegram Post
• https://vuldb.com/?id.7619 · Note