| tiêu đề | Netcore磊科 Router Firmware NAP930 V0.1.241010.141410 Command Injection |
|---|
| Mô tả | An unauthenticated OS command injection vulnerability (CWE-78) was identified in the Netcore NAP930 WiFi 6 access point, firmware version V0.1.241010.141410 (OpenWrt 21.02-SNAPSHOT, mediatek/mt7981, aarch64 cortex-a53).
The web management interface is served by uhttpd on ports 80/443/23355, which executes CGI scripts under /www/cgi-bin/ as root and passes the QUERY_STRING environment variable to them verbatim (no URL decoding). The shell CGI /www/cgi-bin/network_tools splits the raw query string into key/value pairs and passes them to "eval". Its urldecode() sanitizer exists in the script but its invocation line is commented out ("#QUERY_STRING=`urldecode ...`"), so a literal single quote in a parameter value breaks out of the eval quoting. Critically, the eval loop executes BEFORE the session-id length check and the "ubus call session access" authorization check, so no authentication of any kind is required.
Exploitation is a single unauthenticated GET request:
GET /cgi-bin/network_tools?sid=';id>/www/pwn.txt;:' HTTP/1.1
The server responds with result:[6] (authorization rejected), but the injected command has already executed during eval - the error code must not be mistaken for the vulnerability being absent. Fetching /pwn.txt then returns:
uid=0(root) gid=0(root) groups=0(root)
Since the CGI does not URL-decode, quotes and semicolons in the payload must be sent raw, and spaces must be written as ${IFS} (shell-expanded during eval). A root bind shell can be spawned with: sid=';telnetd${IFS}-p${IFS}2323${IFS}-l${IFS}/bin/sh;:' followed by "telnet <target> 2323".
Impact: an unauthenticated attacker on the LAN executes arbitrary commands with root privileges, resulting in full device compromise - disclosure of /etc/shadow, Wi-Fi keys and DDNS credentials, persistence via writable flash, and a pivot point into the managed network. The exposure is amplified by the factory-default empty root password.
The vulnerability was dynamically verified against the firmware emulated with qemu-aarch64 user-mode emulation (original rootfs, uhttpd): the id command executed as root and an interactive root shell was obtained from the emulated device back to the attack host. Sibling CGIs telnet/hello/upgrade were tested and are NOT injectable (busybox ash quoting quirk in their $(echo -n '${val}') variant); only network_tools is affected. |
|---|
| Nguồn | ⚠️ https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/netcore_NAP930%20V0.1.241010.141410%20Router/NAP930_network_tools_command_injection.md |
|---|
| Người dùng | yyycl (UID 100580) |
|---|
| Đệ trình | 15/08/2026 12:47 (cách đây 2 các tháng) |
|---|
| Kiểm duyệt | 28/09/2026 20:37 (1 month later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 411139 [Netcore NAP930 0.1.241010.141410 Network Tools CGI network_tools eval sid nâng cao đặc quyền] |
|---|
| điểm | 20 |
|---|