Basic Information

Description

Netcore NBR200V2 firmware V1.3.241127.071246 contains a remote command injection vulnerability in the CGI diagnostic endpoint. The script parses attacker-controlled query-string parameters and evaluates them with eval before the session check is performed. Because parameter names are not restricted to a safe whitelist and are interpreted as shell code, a remote attacker can inject arbitrary shell commands directly through the HTTP request. This can lead to router reboot, denial of service, or full code execution.

Technical Details

Vulnerability chain:

  1. The CGI endpoint receives a raw HTTP request and exposes the request query string as QUERY_STRING.
  2. The script parses attacker-controlled param, key, and val values:
#QUERY_STRING=`urldecode "$QUERY_STRING"`
while [ true ]; do
    param=${QUERY_STRING%%&*}
    QUERY_STRING=${QUERY_STRING#*&}
    val=${param#*=}
    key=${param%=*}
    eval "${key}='${val}'"
    if [ "$param" = "$QUERY_STRING" ] || [ ${#param} -le 0 ]; then
        break
    fi
done
  1. The sink is the direct shell evaluation of key:
eval "${key}='${val}'"
  1. The injection happens before the script validates sid:
if [ ${#sid} -ne 32 ]; then
    returnerrcode 6
    exit
fi