Basic Information

Description

Netcore NBR200V2 firmware V1.3.241127.071246 contains a remote command injection vulnerability in the firmware upgrade CGI endpoint. The script URL-decodes attacker-controlled query-string data and then evaluates derived parameter names with eval. Although the helper strips several shell metacharacters, newline characters survive decoding and remain syntactically meaningful to the shell. A remote attacker can therefore inject arbitrary shell commands before the session or upgrade validation logic completes. The impact includes remote reboot, denial of service, and arbitrary code execution.

Technical Details

Vulnerability chain:

  1. The CGI script decodes attacker-controlled QUERY_STRING:
QUERY_STRING=`urldecode "$QUERY_STRING"`
  1. The decoding routine removes some characters, but still converts %xx sequences via printf:
str=${str//[\"\'\`|\\<>@?*~!();,.\$\^]/}
str=${str//%/\\x}
str=`printf "$str"`
  1. The decoded string is split into key and val, then evaluated:
while [ true ]; do
    param=${QUERY_STRING%%&*}
    QUERY_STRING=${QUERY_STRING#*&}
    val=${param#*=}
    key=${param%=*}
    eval "${key}='${val}'"
    ...
done
  1. Because %0A becomes a literal newline, eval can be turned into a multi-line shell program.