Basic Information

• Vendor: Netcore
• Vendor Website: https://www.netcoretec.com/service-support/support
• Model: NBR200V2
• Firmware Version: V1.3.241127.071246
• Firmware Download: https://www.netcoretec.com/service-support/download/firmware/2705.html
• Affected Component: /usr/bin/network_tools

Description

Netcore NBR200V2 firmware V1.3.241127.071246 contains a remote command injection vulnerability in the temporary LAN IP configuration functionality. The handler accepts attacker-controlled ipv4 input from a ubus JSON-RPC request and embeds it directly into a shell command. A remote attacker can therefore execute arbitrary shell commands on the device, including rebooting the router or obtaining full code execution.

Technical Details

Vulnerability chain:

1. A remote request reaches the device as:

POST /ubus
{"jsonrpc":"2.0","id":20,"method":"call","params":["<sid>","network_tools","tools_tmpset",{"iface":"lan","ipv4":"<attacker-controlled>"}]}

1. The ubus method mapping routes the request to sub_4017C0:

object.name = "network_tools";
object.methods = 0x412f4c;
"tools_tmpset" -> sub_4017C0

1. sub_4017C0 parses iface and ipv4:

blobmsg_parse(&off_412F94, 2, &v13, a5 + 4, (v6 & 0xFFFFFF) - 4);
...
v7 = v13 + 4;   // iface
...
v8 = v14 + 4;   // ipv4

1. Only iface == "lan" is checked. ipv4 is then injected into a shell command:

v12 = strcmp(v7, "lan");
if ( !v12 )
{
    ...
    snprintf(v15, 0x80u, "sleep 1 && ifconfig br-lan %s netmask 255.255.255.0 &", v8);
    system(v15);
}

• The iface check is not a security control; it only gates the code path.