Summaryinfo

A vulnerability marked as critical has been reported in Netgear Router DG/DGN/DM/JNR/WPNT. Affected by this vulnerability is an unknown functionality of the component Port tcp/32764. Performing a manipulation results in backdoor. Furthermore, an exploit is available. This vulnerability is considered historic because of its background and reception. It is suggested to use restrictive firewalling.

Detailsinfo

A vulnerability was found in Netgear Router DG/DGN/DM/JNR/WPNT (Router Operating System). It has been classified as very critical. This affects an unknown code of the component Port tcp/32764. The manipulation with an unknown input leads to a backdoor vulnerability. CWE is classifying the issue as CWE-912. The product contains functionality that is not documented, not part of the specification, and not accessible through an interface or command sequence that is obvious to the product's users or administrators. This is going to have an impact on confidentiality, integrity, and availability.

The weakness was published 12/31/2013 by Eloi Vanderbeken as backdoor_description.pdf as confirmed presentation (GitHub). It is possible to read the advisory at github.com. The vendor was not involved in the public release. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are unknown but a public exploit is available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 03/24/2019). The attack technique deployed by this issue is T1588.001 according to MITRE ATT&CK. Due to its background and reception, this vulnerability has a historic impact.

A public exploit has been developed by Eloi Vanderbeken in Python and been published immediately after the advisory. The exploit is shared for download at github.com. It is declared as highly functional. We expect the 0-day to have been worth approximately $25k-$100k. The advisory illustrates:

Very simple binary protocol: Header (0xC bytes) followed by a payload

It is possible to mitigate the weakness by firewalling tcp/32764.

The vulnerability is also documented in the vulnerability database at OSVDB (101653†). Further details are available at news.ycombinator.com. Similar entry is available at VDB-11714. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Affected

• Netgear DG834 5.01.09
• Netgear DG834B 5.01.14
• Netgear DG834G 3.01.32 (Rev. 2)/4.01.40 (Rev. 3)
• Netgear DGN1000
• Netgear DGN1000B
• Netgear DGN2000 1.1.1/1.1.11.0/1.3.10.0/1.3.11.0/1.3.12.0
• Netgear DGN3500
• Netgear DM111Pv2 2.00.27
• Netgear JNR3210
• Netgear WPNT834

Productinfo

Type

• Router Operating System

Vendor

• Netgear

Name

• Router

Version

• DG
• DGN
• DM
• JNR
• WPNT

License

• commercial

Website

• Vendor: https://www.netgear.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

Screenshot

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion