| Название | Netcore磊科 Router Firmware NBR1005GPEV2_V1.3.241107.015153 Command Injection |
|---|
| Описание | A command injection vulnerability (CWE-78) was identified in the Netcore NBR1005GPEV2 router, firmware version V1.3.241107.015153 (LEDE 17.01, MIPS16e mipsel / MT7621).
The web management interface (uhttpd, ports 80/443/23355) exposes ubus JSON-RPC at /ubus. The routerd ubus service (binary /usr/bin/routerd, ELF MIPS16e, running as root) implements the "passwd_set" method. The handler passwd_set_api builds a shell command using the user-supplied new-password argument "pwd" and passes it to system() without any sanitization:
snprintf(buf, "uci set auto_ac.auto_ac.passwd=%s;uci commit auto_ac", pwd); // 0x4163f6
system(buf); // 0x4163fc
Because the new password is embedded with NO quoting, a "pwd" value containing $(...), `...`, ;, or | is interpreted by the shell, leading to arbitrary command execution as root. (The "user" argument is validated with isalnum(), and the OLD password is checked by do_check_password — only the NEW password "pwd" is injectable.)
The method is reachable UNAUTHENTICATED during the device's pre-initialization window (it is listed in /usr/share/rpcd/acl.d/unauthenticated.json); after initialization it requires a valid websuperuser session. The handler verifies the current password (do_check_password vs uci system.@system[0].passwd), so the attacker must know it — on a factory-default / unconfigured device the password is empty/known, which effectively removes the barrier.
Proof of concept (ubus call; the same works as a /ubus JSON-RPC POST):
ubus call routerd passwd_set '{"ubus_rpc_session":"00000000000000000000000000000000","user":"root","pwd":"$(id>/www/p.txt)","by":"<current password>"}'
-> GET /p.txt returns: uid=0(root) ...
Impact: remote code execution as root on any device where the current admin password is known/default (including fresh/reset devices during the pre-init window).
The vulnerability was dynamically verified under qemu-mipsel user-mode emulation: strace captured system() executing "sh -c uci set auto_ac.auto_ac.passwd=$(touch /tmp/x);uci commit auto_ac", and the injected command executed (file created as root).
Full technical details (instruction-level taint flow, function addresses, the unauthenticated.json -> .initialized ACL switching mechanism) are available in the GitHub advisory. |
|---|
| Пользователь | llsss (UID 96233) |
|---|
| Представление | 09.08.2026 15:17 (2 месяцы назад) |
|---|
| Модерация | 27.09.2026 11:22 (2 months later) |
|---|
| Статус | Дубликат |
|---|
| Запись VulDB | 310234 [Netcore NBR200V2 до 20250508 HTTP Header /usr/bin/routerd passwd_set pwd эскалация привилегий] |
|---|
| Баллы | 0 |
|---|