| Название | Netcore磊科 Router Firmware NBR1005GPEV2_V1.3.241107.015153 unauthorized Command Injection |
|---|
| Описание | An unauthenticated operating system command injection vulnerability (CWE-78) was identified in the Netcore NBR1005GPEV2 router, firmware version V1.3.241107.015153 (LEDE 17.01, MIPS16e mipsel / MT7621).
The web management interface is served by uhttpd (ports 80/443/23355). Dynamic requests under /cgi-bin/ are handled by shell-script CGIs in /www/cgi-bin/. The network_tools CGI parses the HTTP query string with a shell "eval" statement that executes BEFORE the session-id and permission checks, and the urldecode sanitization call that protects the sibling CGIs (acbackup/upgrade) is commented out in this script:
#QUERY_STRING=`urldecode "$QUERY_STRING"` <- sanitization disabled (line 114)
while ...; do
eval "${key}='${val}'}" <- runs BEFORE auth (line 120)
done
if [ ${#sid} -ne 32 ]; then ... fi <- auth check is AFTER eval (line 127)
Because uhttpd passes QUERY_STRING to the CGI verbatim (no URL-decoding), an attacker fully controls the literal bytes of "val". A query value such as "a';<CMD>;'" makes eval expand to "sid='a';<CMD>;''", breaking out of the single-quoted assignment and executing <CMD> as root. Spaces inside <CMD> are written as ${IFS} (a literal space is illegal in an HTTP request-target).
Exploitation requires NO authentication and NO session token — the injected command executes before any credential check.
Proof of concept (a single unauthenticated request writes the id output into the web root, then reads it back over HTTP):
GET /cgi-bin/network_tools?sid=a';id>/www/p.txt;' HTTP/1.1
Host: <target>
-> GET /p.txt returns: uid=0(root) gid=0(root) groups=0(root)
Impact: unauthenticated remote code execution as root -> full device compromise. A reverse shell is obtained by replacing the injected command with a mkfifo-based payload (the device BusyBox nc has no -e flag).
The vulnerability was dynamically verified under qemu-mipsel user-mode emulation (uhttpd + ubusd manually started): the injected command executed as root before authentication, confirmed by a file written into the web root and read back over HTTP, and by an outbound nc callback from the device to the attacker host.
Full technical details (line-level taint flow, reverse-shell PoC, sibling-CGI analysis) are available in the GitHub advisory.
|
|---|
| Источник | ⚠️ https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/netcore_NBR1005GPEV2_V1.3.241107.015153%20Router/NBR1005GPEV2_network_tools_unauth_rce.md |
|---|
| Пользователь | llsss (UID 96233) |
|---|
| Представление | 09.08.2026 15:11 (2 месяцы назад) |
|---|
| Модерация | 27.09.2026 11:21 (2 months later) |
|---|
| Статус | Дубликат |
|---|
| Запись VulDB | 310235 [Netcore NBR1005GPEV2/NBR200V2/B6V2 до 20250508 /usr/bin/network_tools tools_ping url эскалация привилегий] |
|---|
| Баллы | 0 |
|---|