NETGEAR routers vulnerable to “root” code execution, no patch yet
In a recently released vulnerability disclosure from d4rkn3ss from VNPT ISC as well as Adam Nichols of GRIMM, we learn of an unpatched vulnerability impacting at least 79 NETGEAR router models that can let an attacker execute code with “root” privileges.
Nichols downloaded NETGEAR firmware from their website and began decompiling it using disassemblers and analysis tools like Hex-Rays.
The researcher was able to quickly figure out, browsing through the web server’s code in the firm, that certain variables, such as
user_input were vulnerable to an overflow.
“After the call to read_content (the
recv helper function), the parser does some error checking, combines the received content with any previously received content, and then looks for the strings
"\r\n\r\n" in the user input,” states the disclosure.
“If the user input contains these strings, the rest of the user input after these strings is passed to the
abCheckBoardID function. Grepping the firmware’s root file system, we can see that the string
mtenFWUpload is referenced from the files
www/Modem_upgrade.htm, and thus we can conclude that this is part of the router’s upgrade functionality.”
While most modern devices have protection technologies like “stack canaries”, ASLR and DEP to protect against code execution, should a buffer overflow exploit succeed, this isn’t the case for select NetGear models.
“In most modern software, this vulnerability would be unexploitable. Modern software typically contains stack cookies which would prevent exploitation. However, the R7000 does not use stack cookies. In fact, of all of the Netgear products which share a common codebase, only the D8500 firmware version 22.214.171.124 and the R6300v2 firmware versions 126.96.36.199-188.8.131.52 use stack cookies. However, later versions of the D8500 and R6300v2 stopped using stack cookies, making this vulnerability once again exploitable. This is just one more example of how SOHO device security has fallen behind as compared to other modern software.”
Nichols has provided a proof-of-concept (exploit) for the vulnerability.
The same vulnerability was also disclosed on Zero Day Initiative (ZDI) by d4rkn3ss from VNPT ISC and has been assigned the identifier, ZDI-CAN-9703 while a CVE assignment is pending.
While 79 models of NetGear routers remain unpatched, the disclosures of this vulnerability did not follow the standard guidelines, reads the ZDI advisory:
“Given the nature of the vulnerability, the only salient mitigation strategy is to restrict interaction with the service to trusted machines. Only the clients and servers that have a legitimate procedural relationship with the service should be permitted to communicate with it. This could be accomplished in a number of ways, most notably with firewall rules/whitelisting.”
A list of 79 router models that are vulnerable is as follows:
At this time, it is not known when will a patch be released.