CVE-2013-10060: fallo crítico en Netgear DGN2200B
Netgear Routers pppoe.cgi RCE
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
63Vexday Risk Score
Corrige pronto. Ella tiene exploit funcional público.
ssvc Attendcvss 9.4epss 6.3%
de la publicación al armael mismo día
Publicada en NVD1 ago
metasploit15 feb
An authenticated OS command injection vulnerability exists in Netgear routers (tested on the DGN2200B model) firmware versions 1.0.0.36 and prior via the pppoe.cgi endpoint. A remote attacker with valid credentials can execute arbitrary commands via crafted input to the pppoe_username parameter. This flaw allows full compromise of the device and may persist across reboots unless configuration is restored.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Productos afectados
Netgear · DGN2200BPoCs públicas encontradas — 4
cve_referenceraw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/netgear_dgn2200b_pppoe_exec.rbno verificadocve_referenceweb.archive.org/web/20170422033239/http://www.s3cur1ty.de/m1adv2013-015no verificadocve_referencewww.exploit-db.com/exploits/24513no verificadocve_referencewww.exploit-db.com/exploits/24974no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
Referencias
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/netgear_dgn2200b_pppoe_exec.rbhttps://web.archive.org/web/20170422033239/http://www.s3cur1ty.de/m1adv2013-015https://www.exploit-db.com/exploits/24513https://www.exploit-db.com/exploits/24974https://www.vulncheck.com/advisories/netgear-legacy-routers-rce