Basic Information

• Vendor: Netcore
• Vendor Website: https://www.netcoretec.com/service-support/support
• Model: NBR200V2
• Firmware Version: V1.3.241127.071246
• Firmware Download: https://www.netcoretec.com/service-support/download/firmware/2705.html
• Affected Component: /usr/bin/network_tools

Description

Netcore NBR200V2 firmware V1.3.241127.071246 contains a remote command injection vulnerability in the traceroute diagnostic feature. The traceroute handler accepts an attacker-controlled url value from ubus JSON-RPC, concatenates it into a shell command, and executes the resulting command. A remote attacker can use this flaw to execute arbitrary shell commands, reboot the device, or achieve full system compromise.

Technical Details

Vulnerability chain:

1. The remote request is accepted as ubus JSON-RPC:

POST /ubus
{"jsonrpc":"2.0","id":20,"method":"call","params":["<sid>","network_tools","tools_traceroute",{"action":"start","url":"<attacker-controlled>","max_hop":1,"wanid":0}]}

1. The ubus method mapping routes the request to sub_401BD8:

object.name = "network_tools";
object.methods = 0x412f4c;
"tools_traceroute" -> sub_401BD8

1. sub_401BD8 parses the JSON-RPC data and forwards it to tools_traceroute():

blobmsg_parse(&off_412FA4, 4, &v21, a5 + 4, (v6 & 0xFFFFFF) - 4);
...
v25[0] = v18;                 // action
v25[1] = v7;                  // url
v25[2] = _bswapsi2(*v8);      // max_hop
...
result = tools_traceroute((int)v25);

1. tools_traceroute() builds a shell command using the untrusted url value:

snprintf(
  v4,
  0x100u,
  "(traceroute %s -m %d > %s && echo \"traceroute ending\" >> %s; touch %s)&",
  v2,
  *(_DWORD *)(a1 + 8),
  "/tmp/traceroute.txt",
  "/tmp/traceroute.txt",
  "/tmp/.tracroute_end");
system(v4);

• The vulnerability is structurally identical to the ping issue, but reaches a different sink and execution path.