| عنوان | Netcore磊科 Router Firmware NR289-GE_V1.4.5102 Command Injection |
|---|
| الوصف | An unauthenticated command injection vulnerability (CWE-78) was identified in the Netcore NR289-GE SMB router / AC controller, firmware version V1.4.5102 (Linux 2.6.36, MIPS32r2 big-endian, Realtek RTL8198C+RTL8370 platform).
The web stack (patched boa -> /web/cgi-bin/cgitest.cgi, running as root) dispatches set_ntp_server_ip.cgi to set_ntp_server_ip_cgi (0x4200cc). The handler takes the user-controlled "ntp_ip" form field and, via set_ntpserverip (0x435e88) and send_wget_set_command (0x4353c0, code 0x300021), embeds it into a shell command executed by system() without any input validation or sanitization:
sprintf(cmd, "/bin/wget_1 ... --post-data \"time_server=%s&time_set=1\" \"http://%s/cgi-bin-igd/netcore_set.cgi\" >/tmp/status", ntp_ip, ap_ip);
system(cmd); // cgitest.cgi @ 0x435540
Because the value lands inside double quotes, an "ntp_ip" value such as ";CMD;# breaks out of the quoted string and injects an arbitrary OS command, which executes with root privileges and leads to full compromise of the device.
Exploitation conditions: (1) the "mac" form field's first 6 bytes must match an entry of the AC's bound-AP list (/tmp/para/bind_list_table) - i.e. the device is managing at least one AP, its normal operating state; (2) no authentication is required when the request URI contains the substring ".ico", due to a separate boa whitelist flaw (strstr(uri,".ico") at boa @ 0x407438, reported separately). Field note: ntp_ip is effectively truncated at ~19-20 bytes (unterminated strncpy), giving a ~12-character command budget; longer commands can be staged across multiple requests, and the sibling endpoint location_time.cgi (reported separately) has no such limit. After the injected command runs the CGI response may be empty/aborted - execution must be judged by side effects, not by the HTTP response.
Proof of concept (no credentials):
POST /x.ico/set_ntp_server_ip.cgi
Body: mac=AA%3ABB%3ACC%3ADD%3AEE%3AFF&ntp_ip=%22%3Becho%20pwn%3E%2Ftmp%2Fpn%3B%23
(URL-decoded ntp_ip: ";echo pwn>/tmp/pn;# ; mac first 6 bytes must match a bound AP)
The file /tmp/pn on the device is then created by the injected command.
The same unsanitized pattern exists in sibling handlers in the same binary, all converging on send_wget_set_command: location_time.cgi (mac), ap_ip.cgi (ip/mask/gateway), ac_ip_config_set.cgi (acserver_ip) and wifi_lamp.cgi (mac).
The vulnerability was dynamically verified against the firmware emulated with qemu-mips user-mode emulation; the injected command was executed with root privileges.
|
|---|
| المصدر | ⚠️ https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/netcore_NR289-GE_V1.4.5102%2C2018.06.1418_44%20Router/Netcore_NR289-GE_set_ntp_server_ip_command_injection.md |
|---|
| المستخدم | yyycl (UID 100580) |
|---|
| ارسال | 14/08/2026 02:02 PM (1 شهر منذ) |
|---|
| الاعتدال | 27/09/2026 07:48 PM (1 month later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 410947 [Netcore NR289-GE 1.4.5102 CGI /set_ntp_server_ip.cgi system ntp_ip تجاوز الصلاحيات] |
|---|
| النقاط | 20 |
|---|