Netgear DGN1000B 1.1.00.24/1.1.00.45 setup.cgi TimeToLive os command injection

Summaryinfo

A vulnerability has been found in Netgear DGN1000B 1.1.00.24/1.1.00.45 and classified as critical. The impacted element is an unknown function of the file setup.cgi. The manipulation of the argument TimeToLive leads to os command injection. This vulnerability is traded as CVE-2013-10061. Furthermore, there is an exploit available.

Detailsinfo

A vulnerability was found in Netgear DGN1000B 1.1.00.24/1.1.00.45 (Wireless LAN Software) and classified as critical. This issue affects an unknown part of the file setup.cgi. The manipulation of the argument TimeToLive with an unknown input leads to a os command injection vulnerability. Using CWE to declare the problem leads to CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

An authenticated OS command injection vulnerability exists in Netgear routers (tested on the DGN1000B model firmware versions 1.1.00.24 and 1.1.00.45) via the TimeToLive parameter in the setup.cgi endpoint. The vulnerability arises from improper input neutralization, enabling command injection through crafted POST requests. This flaw enables remote attackers to deploy payloads or manipulate system state post-authentication.

The bug was discovered 10/04/2012. The weakness was shared 02/06/2013 by Michael Messner (m1k3) with s3cur1ty as m1adv2013-005 as not defined advisory (Website). It is possible to read the advisory at s3cur1ty.de. The vendor was not involved in the public release. The identification of this vulnerability is CVE-2013-10061. The exploitation is known to be easy. The attack may be initiated remotely. Additional levels of successful authentication are needed for exploitation. Technical details as well as a public exploit are known. The attack technique deployed by this issue is T1202 according to MITRE ATT&CK.

A public exploit has been developed by m-1-k-3 and been published immediately after the advisory. The exploit is available at exploit-db.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 125 days. During that time the estimated underground price was around $25k-$100k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at Exploit-DB (24464), EUVD (EUVD-2013-7266) and OSVDB (89985†). The entries VDB-7618 and VDB-7620 are related to this item. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Wireless LAN Software

Vendor

• Netgear

Name

• DGN1000B

Version

• 1.1.00.24
• 1.1.00.45

License

• commercial

Website

• Vendor: https://www.netgear.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion